<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> <style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style> </head> <body dir="ltr"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Hey,</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> My main issue with API Keys is them being attached to SSO accounts. What about when the employee leaves the company?</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> He gets removed from auth on the mntner, all the apps he set-up break? Making <span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">admins hesitant about removing user access.</span></div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> API access needs to be bound to the mntner in some form imho.</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> Additionally, would api keys allow querying the API and getting unfiltered data? Or would it just be for `post`ing updates to objects?</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> --</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> I suspect the signed updates have little usage for two major reasons:</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <ul> <li>Figuring out if the update succeeded requires receiving and parsing emails</li><li>Figuring out if the object is up to date on the ripe database is practically impossible* due to filtering (auth: SSO# Filtered)</li></ul> <div>Sending requests with x509 client cert auth means you know who is sending the request and you have no need to filter data (like the auth sso entries) out for objects the mntner has permissions for, making idempotent api clients so much easier to make.</div> <div><br> </div> <div>--</div> <div><br> </div> <div>The logic i might want to implement, in pseudocode:</div> <div><br> </div> <div></div> <span style="font-family: Consolas, Courier, monospace;"></span><span style="font-family: Consolas, Courier, monospace;">while true</span><span><br> </span></div> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <span style="font-family: Consolas, Courier, monospace;">mntners = database(mntners)</span></div> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">foreach mntners as mntner</span></div> </div> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">objects = rest api request for all objects with mnt-by = mntner</span></div> </div> </blockquote> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">foreach objects as object</span></div> </div> </blockquote> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">if object not in database</span></div> </div> </blockquote> </blockquote> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">notify admin .... or delete it</span></div> <div><span style="font-family: Consolas, Courier, monospace;">continue</span></div> </div> </blockquote> </blockquote> </blockquote> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">if object == database(object)</span></div> </div> </blockquote> </blockquote> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">continue</span></div> </div> </blockquote> </blockquote> </blockquote> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <div><span style="font-family: Consolas, Courier, monospace;">rest api request to update object with data from database</span></div> </div> </blockquote> </blockquote> </blockquote> <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <span style="font-family: Consolas, Courier, monospace;">sleep for a while</span></div> </blockquote> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <span style="font-family: Consolas, Courier, monospace;"></span> <div><br> </div> <div>--</div> <div>p.s. sorry about my earlier, mangled email, my email client seems to have gone a bit nuts...</div> <div><br> </div> <div>* okay not "impossible" but really annoying, you'd have to store the last updated timestamp from ripe, for all objects, and if it changes in the ripe db, then we'd have to post the object to see if it changes?</div> <div><br> </div> </div> <div> <div id="Signature"> <div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <hr tabindex="-1" style="display:inline-block; width:98%;"> <b>From:</b> Edward Shryane<br> <b>Sent:</b> Wednesday, March 18, 2020 15:29<br> <b>To:</b> Gunnar Gu�var�arson<br> <b>Cc:</b> Tore Anderson; db-wg@ripe.net<br> <b>Subject:</b> Re: [db-wg] API keys for database maintenance <div><br> </div> </div> <div class="BodyFragment"><font size="2"><span style="font-size:11pt;"> <div class="PlainText">Hi Gunnar,<br> <br> We're indeed also working on Client Certificate authentication (we have tested it, and now it's pending a security review).<br> <br> However, to make use of this, a user must:<br> <br> - Generate an X.509 certificate<br> - Extract the certificate as text and create a key-cert object from it<br> - Associate the key-cert with a maintainer in an auth: attribute<br> - Configure the Whois client to send the client certificate when connecting to the REST API (or Syncupdates).<br> <br> This is not trivial to do, and we can see that although signed updates are supported in Whois, it has low usage.<br> <br> It is still worthwhile to support this, as the credential (secret) is only stored locally on the client.<br> <br> Hopefully API keys will be more "user friendly" and can be used in preference to MD5 hashed passwords.<br> <br> Regards<br> Ed Shryane<br> RIPE NCC<br> <br> <br> > On 18 Mar 2020, at 09:45, Gunnar Gu�var�arson <gunnar.gudvardarson@advania.is> wrote:<br> > <br> > Hey,I think that if we get x509 client certificate authentication for the API working, it might even be easier.<br> > All the UI to add certs and auth them on mntners is already there, the web services just need endpoints that request and use client provided certs.<br> > <a href="https://github.com/RIPE-NCC/whois/issues/534" target="_blank" rel="noopener noreferrer" data-auth="NotApplicable" style=""> https://github.com/RIPE-NCC/whois/issues/534</a><br> <br> </div> </span></font></div> </div> </div> </div> </body> </html>