[db-wg] call for application authorisation ideas

On Fri, Aug 21, 2015 at 01:58:46AM +0200, denis wrote:
> >CALL FOR IDEAS
> >==============
> >
> >Now that personalised authorisation is covered and in progress, what
> >about our poor applications? How should they authenticate with the RIPE
> >DB?
> >
> >I see value in stuff like signalling to RIPE "this token can only be
> >used for the API from this source IP address", I've also heard that
> >OAUTH2 is magic and populair for app2app auth. Or maybe all of this is
> >is overkill and we just need to GPG sign the payload of the requests to
> >rest.db.ripe.net and call it a day?
> 
> Whatever method is adopted let me suggest we avoid introducing a new
> 'anonymous' element to authentication. One or more people should take
> responsibility for running automated processes. So whatever token is chosen
> it should be in PERSON objects.

I beg to differ, applications are not persons, and applications are not
tied to persons (at least not in the organisations where I have done
work). If someone leaves the company, the application must continue to
able operate.

I agree it would be highly preferable if (if any) new token is not
'anonymous', it should be easy for the owner of the process to identify
which application the token belongs to.

Kind regards,

Job