Authentication is a part of AAA system which stands for Authentication, Authorization and Accounting System. In this blog, we will see how SUSI.AI authenticates its client. Let’s first see what each term of AAA means
- Authentication : Authentication means identifying individual user with some unique information. Susi uses email addresses for non-anonymous identity and anonymous identity users are identified by their host name.
- Authorization : It refers to identifying the access rights of the user and granting permissions depending on the user’s authorization level. In Susi we have BaseUserRole as
- ANONYMOUS users who have not logged in
- USER logged in Users
- PRIVILEGED users with special rights, like. moderators
- ADMIN maximum right, that user is allowed to do everything . Depending on the useroles, permissions are specified.
- Accounting : Accounting is referred as keeping track of user’s activity. Susi Server uses DAO in which accounting object is stored as JSONTray. Susi also remembers the chat log of a user.
Now that we have basic idea about AAA, let’s check how Susi authenticates its user.
Susi has ClientIdentity class which extends to base class Client, which has a string sufficient to identify an user. The user are represented with Objects of this class. The client identification string is defined as <typeName: untypedId> pair where <typeName> denotes an authentication method and <untypedId> a name within that authentication domain.
This credential is used as key in DAO.authentication. Parent is used for the storage object , it is null if there is no parent file (no persistency). The DAO uses credential key and implements methods like getAuthentication, getAuthorization,getAccounting taking Non null parameter ClientIdentity and returns the object of respective classes. The method setExpireTime sets an expire time for anonymous users and tokens after end of duration in time seconds passed as parameter the Authentication expires.
The JsonTray is class to hold the volume as <String,JsonObject> pairs as a Json file. The UserRequests class holds all the user activities. The ClientIdentity class extend the base class Client and provides an Identification String for authentication of users.
The AbstractAPIHandler checks the permissions of the user using the userroles of and comparing it with the value minimum base role of each servlet. Thus to specify the user permission for a servlet one just need to extend servlet to AbstractAPIHandler and Override the getMinimalBaseUserRole method.
It also implements method getIdentity() which checks a request for valid login data, an existing session, a cookie or an access token and returns user identity if some login is active, otherwise the anonymous identity.
This is how Susi uses credential to authenticate users and use it for accounting and authorization. The endpoints provided by server are used by Android and web clients. Susi accounts service is at http://accounts.susi.ai. For more details do visit code repository and join gitter chat channel for discussions.
- What is AAA – http://www.webopedia.com/TERM/A/AAA.html
- Authentication and Authorization Service= https://en.wikipedia.org/wiki/Java_Authentication_and_Authorization_Service