[Galene] Re: Config branch [was: User management]

[Jeroen van Veen <jvanveen@protonmail.com>]

Hi Juliusz,

I checked your config branch and the new multiple admins feature.
Nice feature! It allows me to directly map the admin privilege
in Pyrite's users.json to a Galene admin, so multiple users can directly
access an endpoint like stats.json. It may be possible to use the single
admin user in Pyrite's Node.js service to proxy the request, but it's
better to have this directly in Galene I think(less dependencies).

How would JWT authentication impact the storage of credentials in Galene? I encountered
JWT authentication recently and noticed it contains user information payload. Would that
impact where the user's credentials may be stored? For instance, would Galene call a
configurable HTTP endpoint that will do the authentication and return a JWT?
What user information will be stored by Galene? The JWT? I don't have
a solid understanding of how that's supposed to work yet. Would it make sense to
have user deduplication with the current file/authentication scheme like this?

data/users.json
[
    {"id": "3930b479-e669-432c-b163-8a3c79475820", "username": "root", "password": "secret"},
    {"id": "b0fba23a-4441-47dc-97ca-545a5b6b9142", "username": "foo", "password": "bar"}
]

data/config.json
{
    "admin": [
        "3930b479-e669-432c-b163-8a3c79475820"
    ]
}

data/groups/my-group.json
{
    "op": ["3930b479-e669-432c-b163-8a3c79475820"],
    "presenter": ["b0fba23a-4441-47dc-97ca-545a5b6b9142"]
}

One last thing; in case a central users.json makes sense; would it be helpful to allow
Galene to permit unknown fields, to be able to store additional arbitrary user
information? e.g.

data/users.json
[
    {"id": "3930b479-e669-432c-b163-8a3c79475820", "username": "root", "password": "secret", "profile": {"email": "root@domain.org"}},
    {"id": "b0fba23a-4441-47dc-97ca-545a5b6b9142", "username": "foo", "password": "bar", "profile": {"email": "foo@bar.org"}}
]

Kind regards,

Jeroen

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

Op dinsdag 26 oktober 2021 om 9:02 PM schreef Juliusz Chroboczek <jch@irif.fr>:

> Jeroen,
>
> I've just pushed a new branch
>
> git checkout -b config https://github.com/jech/galene
>
> which implements a global configuration file and removes the data/passwd
>
> file. Please review, and let me know what you think.
>
> (I'm going to use the global config file to hold shared secrets and public
>
> keys as I implement third party authentication with JWTs, so while it's
>
> not overly urgent, please do review, since we'll be stuck with it once
>
> people start developing auth servers for Galene.)
>
> -- Juliusz