Authentication with proxy and HTTP signature?

[srosset81]

The ActivityPub specs mentions the possibility to use a proxyUrl to make requests to remote servers:

proxyUrl
Endpoint URI so this actor’s clients may access remote ActivityStreams objects which require authentication to access. To use this endpoint, the client posts an x-www-form-urlencoded id parameter with the value being the id of the requested ActivityStreams object.

I’ve been using this for the ActivityPods project and it’s working fine. Basically, all requests to remote servers are done through this endpoint. The request is forwarded to the remote server, adding a HTTP signature which signs the message with a public/private keys mechanism, that the remote server can easily verify the WebACL rights on the resource (the actor’s public key being attached to the its profile)

I’m wondering if there are security concerns which prevent to use this everywhere ? Isn’t it a simple and elegant way to authentify users accross as many servers as we want ? I find the Solid-OIDC spec difficult to implement, while with this proxy solution, users can create POD accounts however they like, and still be recognized by remote servers.

The only thing missing in the above ActivityPub spec is the possibility to handle POST, PUT, PATCH and DELETE methods. But it’s possible to adapt it for such cases, it’s just an API. However I would like to make sure I’m not missing something before implementing this solution…

Thanks !

[GuillaumeAV]

@bblfish what do you think about this solution ?

[lecoqlibre]

It seems that some discussions are currently running on this topic in the authentication panel. We mentioned this during the community group call. Ping @elf-pavlik

Notification Sender - authentication may require both identities client & agent (user)

Authentication: exchanging public keys, signing messages

[Babelfish]

That seems very close to what I demoed recently at the Solid Community Group last week. Doing HTTP Sig authentication via your POD proxy seems like the right idea to me. One could also do it via the client. But I agree with you it is a lot more efficient.

HTTP Sig Auth Demo for Big(Linked)Data

At last week’s Solid Community Group Meeting I gave a demo of a Spider crawling access controlled #LDES data published on my Reactive-Solid server. I demonstrate this with HTTPSig authentication showing that this is pretty much as close to the most efficient we could get. I show the sequence diagram and the packets going on the wire in this recording: [Screenshot of Demo] Tim Berners-Lee during the call suggested that it could be perhaps even more efficient if the server returned the Web Acces…

It would be interesting to get your feedback on the HTTPSig spec that I am writing up here (I will put some more work into this very soon, after having collected the experience from my recent work)

https://github.com/bblfish/authentication-panel/blob/sigUpdate/proposals/HttpSignature.md

[jeswr]

@srosset81: I’m helping @Babelfish prototype HTTP Sig on the CSS here; feel free to reach out if this work interests you and you want to be involved in this.