Security Propagation for Web Applications

Proper integration of Web applications with Stardust requires the Web application to safely know on behalf of which Stardust user it is being invoked. This information typically includes basic identity information as a user ID and mail address. For certain integration scenarios it might additionally include access or session tokens provided by an external system, which can be used to invoke backend services from the Web application. As with all identity related pieces of information great care needs to be taken to ensure:

Fortunately there exists a variety of protocols providing blueprints for safely passing user identity and communicating authorizations between applications. One such protocol especially suited for Browser based Web applications is OAuth v2.0 (with the OpenID Connect Core v1.0 extensions), thus it was chosen as a foundation for the integration Stardust provides.

Note: At the time of writing Stardust is not a full OAuth v2.0/OpenID Connect v1.0 Authorization Server. It just leverages parts of the OpenID Connect Implicit Flow to safely pass user identity from Stardust to an external Web application.

How Stardust passes user identity to an external Web application

User identity is being passed in alignment with the OpenID Connect v1.0 Implicit Flow (namely steps 5 and 6 as equivalents of steps 1 to 4 are already implied). However, in an attempt to simplify development of external Web applications, Stardust provides an easily deployable implementation of the relevant client part (aka. the auth-proxy page). This implementation consists of a simple HTML page which will exchange an access token for the full identity and convert any potentially associated tokens into session cookies. The exact sequence of steps is as follows:

  1. A user logs into Stardust, potentially performing authentication against an external identity provider
  2. Eventually the user uses the Stardust portal to invoke an external Web application

This feature is guarded by a global property org.eclipse.stardust.ui.web.feature.mashupCredentialsPropagation. If required, you may adjust this entry as follows in your WARs carnot.properties

org.eclipse.stardust.ui.web.feature.mashupCredentialsPropagation = withSessionTokens

Possible values are:

Frequently Asked Questions

  1. Why is identity information not simply passed as query parameters?
  2. Why do I have to deploy an Stardust provided auth-proxy page with my application?
  3. What steps do I have to take to deploy Stardust's auth-proxy page?
  4. Does the use of cookies imply sensitive information is at risk?
  5. From where do I get the authorization proxy page?