ramses-auth

Implementation of RAMSES - Robust Access Model for Securing Exposed Services

1. Introduction
2. Installation
3. Usage
4. Testing
5. Contribution
6. License

Introduction

RAMSES is an easily adoptable, customizable and robust security model which will not consider any trusted zones. It proposes an authentication and authorization pattern for inter-service communication utilizing and extending JSON Web Signatures (JWS) as tickets. RAMSES includes various extensions for individual security levels and requirements, like access capabilities, ticket invalidation, usage limitation and payload encryption.

A detailed explanation of RAMSES will follow.

Installation

For installation use the Node Package Manager:

$ npm install --save ramses-auth

or clone the repository:

$ git clone https://github.com/KorbinianKuhn/ramses-auth

Usage

ramses.sign(payload, key, [options, callback])

Return a JSON Web Signature.

Options:

• payload {Object} - The payload data for the jws.
• key {Object} - Private key to sign the jws.

options

• alg {string} - Parameter name for describing the algorithmDefault: RS256
• jti {boolean} - Add a unique JWT ID (uuidv4). Default true.
• iat {boolean} - Add issued at timestamp. Default true.
• ttl {number} - time to live / lifetime of the token. The value will be added to the current time and stored as expiration time under the exp claim.
• jpi {string}
  • type {string} - Values (root, parent, chain).
  • parent {Object} - The parent token as JWS.
• encrypt (Array[Object]) - An array of objects that have to contain the following claims:
  • aud {Array[string]} - The audience or audiences that the encryption is meant for.
  • alg {string} - The encryption algorithm.
  • content {Object} - The content that will be encrypted.
  • key {Object} - The public key of the audience defined in the aud claim.

alg must be one a value found in ramses.ALGORITHMS. If payload is not a buffer or a string, it will be coerced into a string using JSON.stringify.

Example:

//Sign a token with a unique id and a lifetime of 5 minutes and a parent ticket
const payload = {key: 'value'};
const options = {
    jti: true,
    ttl: 300,
    jpi: {
        parent: token
    }
};

ramses.sign(payload, issuer.privateKey, options, function(err, token) {
    console.log(token);
});

//Sign a token with encrypted content for the audience
const token = ramses.sign(payload, issuer.privateKey, {
        encrypt: [
            {
                aud: ['Audience'],
                key: audience.publicKey,
                content: {
                    secret: 'value'
                }
            }
        ]
    }, function(err, token) {
        console.log(token);
});

ramses.verify(token, key, [options, callback])

Verify a JWS token. Returns true or false.

Options:

• token {String} - The token as JWS.
• key {String} - The public key of token issuer.

options

• aud - Define the audience that has to exist in the tokens aud claim.
• azp - Define the authorized party that has to exist in the tokens azp claim.
• isValidCallback {function} - Add a custom function that will be executed for validation. The function receives the payload of the decoded token as an argument.

Example:

//Verify token
ramses.verify(token, issuer.publicKey, function(err, dtoken) {
    console.log(err);
});

//Verify token with all options
ramses.verify(token, issuer.publicKey, {
        aud: 'Audience',
        azp: 'AuthorizedParty',
        isValidCallback: customCallbackFunction
    }, function(err, dtoken) {
        console.log(err);
});

ramses.decode(token [, options])

Return a decoded JWS. The returned object contains header, payload and signature.

Options:

token {String} - The token as JWS.

options

• decrypt {object} - Automatic decryption of encrypted payload data epd if existent and the audience matches.
  • aud {String} - The audience that has to be part of epd claim.
  • key {String} - The private key for decryption.

Example:

//Decode a token
const dtoken = ramses.decode(
    token: token
)

//Decode and automatically decrypt epd content of a token
const dtoken = ramses.decode(
    token: token,
    options: {
        decrypt: {
            aud: 'Audience',
            key: audience.privateKey
        }
    }
)

Testing

First you have to install all dependencies:

$ npm install

To execute all unit tests once, use:

$ npm test

To get information about the test coverage, use:

$ npm run coverage

Contribution

Fork this repository and push in your ideas.

Do not forget to add corresponding tests to keep up 100% test coverage.

License

The MIT License

Copyright (c) 2017 Korbinian Kuhn, Tobias Eberle, Christof Kost, Steffen Mauser, Marc Schelling

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.