Improve documentation

[martin31821]

• User documentation

  • Using WS endpoint
  • Using WSS endpoint
  • Using TLS authentication
    • How to PKI
  • Using Ticket authentication
    • Using resume tokens
    • Separation between Ticket check and auth role list functions
  • Anonymous authentication

• Developer documentation

  • Start improving this tool

• Release information

[goldcode88]

Can you give a config.json example firstly? Thanks

[johannwagner]

There is no config.json.
You can configure the entire autobahnkreuz using commandline flags. I will get up a basic example within the next 24h.

[goldcode88]

Thanks. --authorizer-func --ticket-check-func --ticket-get-role-func ... is complex input without detail description.

[martin31821]

@goldcode88 can you read over the documentation in the referenced PR and give us some feedback?

[goldcode88]

@martin31821
OK. I'll try autobahnkreuz according to the doc tomorrow, and then give you feedbacks.

[goldcode88]

@martin31821 @johannwagner
I have tried autobahnkreuz according to the doc. I can't boot autobahnkreuz normally for --feature-authorizer-mapping-func or .

I think it's preferable if more details can be provided.

1. --ticket-check-func : From the doc, the string seems like checkTicket written by golang. But I think it's registered wamp's procedure, it can be implemented by nexus, autobahn.js or autobahn.py.
   For example, session.register('com.myapp.ticket.check', function). So --ticket-check-func string should be 'com.myapp.ticket.check'.
   --ticket-get-role-func --authorizer-func --feature-authorizer-mapping-func --feature-authorizer-matrix-func is the same.
   Maybe I misunderstood something.

2.--feature-authorizer-mapping-func and --feature-authorizer-matrix-func's description need provide input args and output result. I think it's also registered wamp's procedure. If nexus or autobahn.js client's example is provided, it'll be understood better.

Edited:
"user.token.authenticate" is registered wamp's procedure.
"user.get.roleid" is a faked string.
"user.get.authorizer.map" is a faked string.

$./autobahnkreuz --realm realm01 --ws-host test.example.com --ws-port 8901 --enable-anonymous --anonymous-authrole public --enable-ticket --ticket-check-func "user.token.authenticate" --ticket-get-role-func "user.get.roleid" --enable-feature-authorization true --enable-authorization true --feature-authorizer-mapping-func "user.get.authorizer.map"
[DEBUG ] 12:04:22.956 main@main.go:249 -- Interconnect startup
[CRITICAL] 12:04:22.956 github.com/EmbeddedEnterprises/autobahnkreuz/cli@cli.go:182 -- Can't enable both authorizers. Choose one!

[martin31821]

It states exactly the problem with your configuration, which is that you have enabled both authorization ways. I added some documentation for the authorization part of autobahnkreuz, so it should be more clear how the parameters work together.

a valid command line which I am using for development is the following:
autobahnkreuz --enable-wss=false --enable-authorization=false --realm=$REALM --anonymous-authrole=public --ticket-check-func=$AUTHFUNC --ticket-get-role-func=$ROLEFUNC --exclude-auth-role=system,trusted

[goldcode88]

@martin31821
Thanks!

./autobahnkreuz --enable-wss=false --ws-host 127.0.0.1 --ws-port 8901 --enable-authorization=false --realm=realm --anonymous-authrole=public --ticket-check-func="user.token.authenticate" --ticket-get-role-func="user.token.authenticate" --exclude-auth-role=system,trusted

[DEBUG   ] 20:04:29.908 main@main.go:249 -- Interconnect startup
[INFO    ] 20:04:29.908 main@main.go:97 -- Enabling anonymous authentication, role: public
[INFO    ] 20:04:29.908 main@main.go:109 -- Enabling ticket auth, func: user.token.authenticate, roles: user.token.authenticate
[INFO    ] 20:04:29.908 main@main.go:119 -- Enabling resume token auth, roles: user.token.authenticate
2018/07/22 20:04:29 Starting router
2018/07/22 20:04:29 Added realm: realm
[INFO    ] 20:04:29.912 main@main.go:273 -- Router started, local client connected.
[CRITICAL] 20:04:29.913 github.com/EmbeddedEnterprises/autobahnkreuz/auth@resume.go:53 -- Failed to register create-token method!

The key of problem is ticket-check-func need a function, but "user.token.authenticate" is a wamp's endpoint created by autobahn.js.

func NewDynamicTicket(authfunc string, authrolefunc string, realm string, invalid mapset.Set, allowtoken bool) (*DynamicTicketAuth, error) {
	x := &DynamicTicketAuth{
		SharedSecretAuthenticator: SharedSecretAuthenticator{
			AuthMethodValue:  "ticket",
			InvalidAuthRoles: invalid,
			Realm:            realm,
			UpstreamGetAuthRolesFunc: authrolefunc,
		},
		UpstreamAuthFunc: authfunc,
		AllowResumeToken: allowtoken,
	}
	return x, nil
}

I thinks it's more flexible if authfunc is replaced by result, err := caller.Call(ctx, "user.token.authenticate", nil, callArgs, nil, ""). So authorization function can be implemented by any client language. Of course, current authorization's method have better performance.

[martin31821]

As you can see here we already invoke the ticket-check-func. Any functions you pass to autobahnkreuz via command line flags are wamp functions.

The error you are seeing was fixed in 0.9.2, are you sure you are running the latest version? (i.e. docker v0.9.2 or edge or git v0.9.2 or master)

Edit:
Some technical details: The NewDynamicTicket creates a dynamicTicketAuthenticator which is passed to nexus and gets invoked once a client connects and specifies authmethod ticket, in which case Authenticate() will get called, which invokes the specified ticket-check-func and later the ticket-get-role-func.

[goldcode88]

@martin31821
Yeah! I use the old version (your first commit).
For v0.9.2, I git clone from github.com. But I get and build it failure.

go get github.com/EmbeddedEnterprises/autobahnkreuz
# github.com/EmbeddedEnterprises/autobahnkreuz/filter
go/src/github.com/EmbeddedEnterprises/autobahnkreuz/filter/complex.go:19:15: undefined: router.PublishFilter

go build
# github.com/EmbeddedEnterprises/autobahnkreuz/filter
filter/complex.go:19:15: undefined: router.PublishFilter

[martin31821]

Please use burrow or the prebuilt docker image. Using go get will get you the wrong dependencies.