Elegant
authentication

Authentication

The Authentication can be a reusable module designed to handle user authentication, ensuring secure login, registration, password management, and role-based access control (RBAC) across multiple services or applications. It provides standard methods and interfaces for validating user credentials, managing authentication tokens, and maintaining session integrity.

Features

Components

The Authentication Common Component typically consists of the following modules:

  1. Authentication API
  2. User Management Service
  3. Token Service
  4. Password Management
  5. Session Service
  6. Roles and Permissions

Authentication Flow

1. Login

Example Request (POST):

   {
     "username": "user@example.com",
     "password": "securePassword123"
   }

Example Response (200 OK):

   {
     "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjM0NTY3ODkwLCJpYXQiOjE2MTYyOTkxMTIsImV4cCI6MTYxNjMwMjExMn0.9Q7nhtzE...",
     "refresh_token": "rNjhvn8aP4l0Bc0hrFqFtrh0",
     "expires_in": 3600
   }

2. Registration

Example Request (POST):

   {
     "username": "newuser@example.com",
     "password": "newSecurePassword123",
     "first_name": "John",
     "last_name": "Doe"
   }

Example Response (201 Created):

   {
     "message": "User successfully registered."
   }

3. Password Recovery

Example Request (POST):

   {
     "email": "user@example.com"
   }

Example Response (200 OK):

   {
     "message": "Password reset email sent."
   }

4. Password Reset

Example Request (POST):

   {
     "reset_token": "abc123xyz",
     "new_password": "newPassword123"
   }

Example Response (200 OK):

   {
     "message": "Password successfully reset."
   }

Token Service

JWT Authentication

The ACC uses JWT (JSON Web Tokens) for stateless authentication, meaning the server does not need to store session data. The token contains information about the user and is signed to prevent tampering.

JWT Structure:

Token Expiration

Example of Token Generation:

{
  "user_id": 123456,
  "email": "user@example.com",
  "roles": ["user", "admin"],
  "iat": 1627905189,
  "exp": 1627908789
}

Roles and Permissions

The ACC supports Role-Based Access Control (RBAC). Roles are assigned to users, and these roles determine what actions they can perform within the application.

Role Definitions:

Permission Checks:

Each API request that requires authorization must include a valid JWT or session token. Based on the user’s role, the system will grant or deny access to specific resources.

Example:

Session Management

Multi-factor Authentication (MFA) (Optional)

If enabled, users will be prompted for an additional form of authentication, such as a one-time passcode (OTP) sent via email or SMS, after entering their primary credentials.

API Endpoints

Endpoint Method Description
/auth/login POST Login and obtain access token
/auth/register POST Register a new user
/auth/forgot-password POST Request password reset
/auth/reset-password POST Reset password using a token
/auth/refresh-token POST Obtain a new access token using refresh token
/auth/logout POST Log out (terminate session)

Error Handling

Security Considerations

References