[Enhancement] Implement authentication in DataCubeServer

[mmebsout]

Put back DataCubeServer authentication feature the right way.
Authentication has been disabled in DataCubeServer with this commit.

The authentication did not make any difference between public or private folders depending on the authenticated profile.

[J-Christophe]

The authorization seems to be performed at the client side (https://github.com/MizarWeb/DataCube/blob/291d206c187f5c25f9fa21ca9530ddffa4ed28cb/src/app/home/dataCube/dataCube.component.ts#L132-L143) instead of the server side (I do not see any control of authorization). This is not nice.

[mmebsout]

@J-Christophe Sorry I didn't mean to assign you. I'm sure you have a lot to do. We are going to use it on public files so far so it's not urgent on our side but should definitely not be forgotten hence the ticket :)

[mmebsout]

@J-Christophe There is some check on the Server if the property no_credentials_needed is false
MizarWeb/DataCubeServer@ba0fb31 but there is no check whereas the profile has access to this or that folder.

[J-Christophe]

Agree, only on authenticate resource there is a check. But the others resources, nothing. Actually, the authenticate resource should return a json web token (https://jwt.io/).Then this token should be sent by the gui. The code for each resource (except authenticate) retrieves the token from the http header and uncrypt the token to find the username. Based on the username, a logic must be implemented to allow or not this user Le jeu. 11 mars 2021 à 10:30, mmebsout ***@***.***> a écrit :

…

@J-Christophe <https://github.com/J-Christophe> I mean there is some check on the Server if the property no_credentials_needed is false ***@***.*** <MizarWeb/DataCubeServer@ba0fb31> but there is no check whereas the profile has access to this or that folder. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#37 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAU6DFKJ6L3EL4PQGQMV673TDCERVANCNFSM4Y6I4MAQ> .

[mmebsout]

Ah yes I remember. yep this is wrong.