Fiware Orion - pepProxy

Question

i'm part of a team that is developing an application that uses the Fiware GE's has part of the Smart-AgriFood accelerator. We are using the Orion Context Broker for gathering the data provided by the sensor network, and we intend to use the Pep-Proxy to authenticate the sensor node for access the Orion instance. We have tried the following pepProxy's:

https://github.com/telefonicaid/fiware-orion-pep

https://github.com/ging/fi-ware-pep-proxy

We only have success implementing the second (fi-ware-pep-proxy) implementation of the proxy. With the fiware-orion-pep we haven't been able to connect to the Keystone Global instance (account.lab.fi-ware.org), we have tried the account.lab... and the cloud.lab..., my question are:

1) is the keystone (IDM) instance for authentication the account.lab or the cloud.lab?? and what port's to use or address's?

2) is the fiware-orion-pep prepared for authenticate at the account.lab.fi-ware.org?? here is way i ask this:

This one works with the curl command at >> cloud.lab.fiware.org:4730/v2.0/tokens

{
    "auth": {
        "passwordCredentials": {

                   "username": "<my_user>",
                    "password": "<my_password>"
                }
            }
}'

This one does't work with the curl comand at >> account.lab.fi-ware.org:5000/v3/auth/tokens

{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "domain": {
                        "name": "<my_domain>"
                    },
                    "name": "<my_user>",
                    "password": "<my_password>"
                }
            }
        }
    } }'

3) what is the implementation that i should be using for authenticate the devices or other calls to the Orion instance???

Here are the configuration that i used:

fiware-orion-pep

config.authentication = {
    checkHeaders: true,
    module: 'keystone',
    user: '<my_user>',
    password: '<my_password>',
    domainName: '<my_domain>',
    retries: 3,
    cacheTTLs: {
        users: 1000,
        projectIds: 1000,
        roles: 60
    },
    options: {
        protocol: 'http',
        host: 'account.lab.fiware.org',
        port: 5000,
        path: '/v3/role_assignments',
        authPath: '/v3/auth/tokens'
    }
};

fi-ware-pep-proxy (this one works), i have set the listing port to 1026 at the source code

var config = {};

config.account_host = 'https://account.lab.fiware.org';

config.keystone_host = 'cloud.lab.fiware.org';
config.keystone_port = 4731;

config.app_host = 'localhost';
config.app_port = '10026';

config.username = 'pepProxy';
config.password = 'pepProxy';

// in seconds
config.chache_time = 300;
config.check_permissions = false;

config.magic_key = undefined;

module.exports = config;

Thanks in advance for the time ... :)

Daniel Morán Jiménez Daniel Morán Jiménez · Accepted Answer · 2015-04-13T06:29:26

The are currently some differences in how both PEP Proxies authenticate and validate against the global instances, so they do not behave in exactly the same way.

The one in telefonicaid/fiware-orion-pep was developed to fulfill the PEP Proxy requirements (authentication and validation against a Keystone and Access Control) in individual projects with their own Keystone and Keypass (a flavour of Access Control) installations, and so it evolved faster than the one in ging/fi-ware-pep-proxy and in a slightly different direction. As an example, the former supports multitenancy using the fiware-service and fiware-servicepath headers, while the latter is transparent to those mechanisms. This development direction meant also that the functionality slightly differs from time to time from the one in the global instance.

That being said, the concrete answer: - Both PEP Proxies should be able to contact the global instance. If one doesn't, please, fill a bug in the issues of the Github repository and we will fix it as soon as possible. - The ging/fi-ware-pep-proxy was specifically designed for accessing the global instance, so you should be able to use it as expected.

Please, if you try to proceed with the telefonicaid/fiware-orion-pep take note also that: - the configuration flag authentication.checkHeaders should be false, as the global instance does not currently support multitenancy. - current stable release (0.5.0) is about to change to next version (probably today) so maybe some of the problems will solve with the update.

Hope this clarify some of your doubts.

Fiware Orion - pepProxy

2 Answers