Resource Server (RS) Security over HTTP

• Configuration of the RS component:
  • RS id: NicePlugfestRS
  • AS issuer name: NicePlugfestAS
  • AS public signature verification key for RS256 use the JWK object obtained from https://plugfest.thingweb.io:8443/wos/0.1/oauth/jwk Which is for this plugfest equal to:

    {
    keys: [
      {
        kty: "RSA",
        e: "AQAB",
        use: "sig",
        kid: "273993369",
        alg: "RS256",
        n: "3lh9zHIe3Zi4mfYpl7AwU25dP4Axvt4WTpM2_l86YX8DBFeBzvuTE5U2yIpH_Cs9vUZnMjkwok3ez8SKzvFb6mTlPY9Lfu6Gk7_dfsolFKJoq97aNbHU_i47YOQG_Ecni4i6DhWcDKQkyA6KFAmjZZ_gxZJekisSkewuKSmDo8M"
      }
    ]
    }
                          

• Registration

  Skipped for RSs that support RS256 for now.

• Operation when receiving a HTTP request at a protected endpoint
  1. Check if the request contains an Authorization header. Respond with a 401 error if not
  2. Check if the request contains an Authorization: Bearer-header with non-null/empty contents. Respond with a 401 error if not
  3. Check if the value of the Authorization: Bearer-header is a JWT object. Respond with a 401 error if not
  4. Check if the JWT object is signed. Respond with a 401 error if not
  5. Check if the signature of the JWT object is valid. This is to be checked with AS public signature verification key (see above). Respond with a 401 error if invalid
  6. Check the contents of the JWT object
     • Check if the value of "iss" is NicePlugfestAS. Respond with a 401 error if not
     • Check if the value of "aud" is NicePlugfestRS. Respond with a 401 error if not
  7. Accept the request as well as "sub" as the originator of the request and process it as usual

Client (C) Security over HTTP

• Registration

  Registration is done according [[!RFC7591]] and described in the following.

  Create a HTTP request with JSON request content as in the following prototype and send it via TLS to the AM.

  For the PlugFest use URL: https://plugfest.thingweb.io:8443/wos/0.1/oauth/register.
  Note that the registration endpoint is unprotected for the purpose of the Plugfest.

  Request
  POST /wos/0.1/oauth/register HTTP/1.1

  Request headers
  Host: plugfest.thingweb.io
Content-Type: application/json
Accept: application/json

  Request body
  {
"client_name": "yourClientName",
"grant_types": ["client_credentials"]
}

  Naming convention: replace all values prefixed "your" with your value i.e. use any string of your choice instead "yourClientName"

  Response

  Check that you get a 201 Created response and extract the value of client_id (this value is called <c_id> in the following) and the value of client_secret (called <c_secret> in the following) from the JSON response body. A response body prototype is:

  {
  "client_id": "889d02cf-16dd-4934-9341-a754088faxyz",
  "client_secret": "ahd5MU42J0hIxPXzhUhjJHt2d0Oc5M6B644CtuwUlE9zpSuF14-kXYZ"
  }
                      

  Store <c_id> and <c_secret> for use during the token acquisition.

• Token Acquisition

  Create a HTTP request as in the following prototype and send it via TLS to the AM.

  For the PlugFest use URL: https://plugfest.thingweb.io:8443/wos/0.1/oauth/token.
  Note that the registration endpoint is unprotected for the purpose of the Plugfest.

  Request
  POST /wos/0.1/oauth/token HTTP/1.1

  Request headers
  Host: plugfest.thingweb.io
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Authorization: Basic Base64(<c_id>:<c_secret>)

  Request body
  grant_type=client_credentials

  Response

  Check that you get a 200 OK response and extract the value of the access_token member from the JSON response body. A response body prototype is:

  {
  "access_token": "eyJraWQiOiIyNzM5OTMzNjkiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiI2MTAyYjk4NC1lNGI0LTQ5ZjctYmRiZC1hOGViMWY0ZmQxMzYiLCJzdWIiOiI2MTAyYjk4NC1lNGI0LTQ5ZjctYmRiZC1hOGViMWY0ZmQxMzYiLCJpc3MiOiJodHRwczpcL1wvcGx1Z2Zlc3QudGhpbmd3ZWIuaW86ODQ0M1wvd29zXC8wLjFcL29hdXRoXC8iLCJ0eXAiOiJvcmc6dzM6d290Omp3dDphbTphcy13cmFwOm1pbiIsImFzX3Rva2VuIjoiZXlKcmFXUWlPaUl5TnpNNU9UTXpOamtpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKemRXSWlPaUkyTVRBeVlqazROQzFsTkdJMExUUTVaamN0WW1SaVpDMWhPR1ZpTVdZMFptUXhNellpTENKaGRXUWlPaUpPYVdObFVHeDFaMlpsYzNSU1V5SXNJbWx6Y3lJNklrNXBZMlZRYkhWblptVnpkRUZUSWl3aWRIbHdJam9pYjNKbk9uY3pPbmR2ZERwcWQzUTZZWE02YldsdUlpd2lhblJwSWpvaU5qWmxaRGs0TURJdE1XWTNZaTAwWWpGaExXRm1NVE10TlRFNE1UZGtNRGMwWVdObEluMC5ub2xsWTFfWHQ1b2llM3EtdHFzbjJZejBqNmhTUEJOQnRDMWdVQmFKRjc4VDZjLUc4UVB6MVo4aVNUdzRmV2JmRE9yNFV0cjNmTFNkbi00Q0NKb0xGbWIxQWp1eTBaNGMybmdhbTJCSVB2d0RubzZoLTRHbXFkLU01cnNQV2EteS1md3I0Yi0yVFdiY2p2Vm9xb0wyWDR1c2RMeHNLcDFza0Z6YUxCVUpmTTQiLCJqdGkiOiI0M2U4MjJlMC00N2VhLTRlOWQtYmVhYi1hNGNmZjRkOGNhZjAifQ.axhPGhk6BCP0WgzojCtwWIcpw7kmG53Gb4TiopYLMAhXPfzPmqpEZKBYWQmDeRNkFVx2xjmmw1MAam-HIfyHJbTWQAP68tKq9HIfHt6I0XraG0hvb-RP8ECEmm7pPWw1F4GntKebrjP4TawmoQpmn9MLaBuxhTpcGMo8UTkOmqA",
  "token_type": "bearer",
  "expires_in": 3600
  }
                      

  Decode the value of the access_token value. This provides a JWT structure. Optionally validate it (see above for JWT validation hints). Extract the value of the as_token member in the JWT payload. This value is called <as_token> in the following.

• Operation when requesting HTTP to a protected endpoint
  • Attach an Authorization: Bearer <as_token> header to HTTP requests to RS.

Resource Server (RS) Security over CoAP

• Configuration of the RS component

  Same as for HTTP communications. See above.

• Registration

  Same as for HTTP communications. See above

• Operation when receiving a CoAP request at a protected endpoint
  1. Check if the request contains a CoAP option 65000 with non-null/empty contents. Respond with a 4.01 error if not
  2. Check if the value of the CoAP option 65000 content is Bearer <jwt_token> with a non-null/empty <jwt_token>. Respond with a 4.01 error if not
  3. Check if the JWT object is signed. Respond with a 4.01 error if not
  4. Check if the signature of the JWT object is valid. This is to be checked with AS public signature verification key (see above). Respond with a 4.01 error if invalid
  5. Check the contents of the JWT object
     • Check if the value of "iss" is NicePlugfestAS. Respond with a 4.01 error if not
     • Check if the value of "aud" is NicePlugfestRS. Respond with a 4.01 error if not
  6. Accept the request as well as "sub" as the originator of the request and process it as usual

Client (C) Security over CoAP

• Registration

  Same as for HTTP communications. See above.

• Token Acquisition

  Same as for HTTP communications. See above.

• Operation when requesting CoAP to a protected endpoint
  • Attach a Bearer <as_token> as value of the CoAP option 65000 to CoAP requests to RS.