[GitHub] [incubator-dubbo] liuxinggang opened issue #3560: dubbo 没有针对消费端应用授权的机制

["liuxinggang (GitHub)" <gi...@apache.org>]

dubbo目前的安全策略有两个：
1，令牌验证：放在consumer没经过注册中心获取到token就访问
2，保护provider，只允许某些ip的consumer访问：只允许某些ip来访问，类似黑白名单

没有比较灵活的根据consumer的服务名，和provider的接口以及方法来配置授权，实现访问控制的机制。



[ Full content available at: https://github.com/apache/incubator-dubbo/issues/3560 ]
This message was relayed via gitbox.apache.org for notifications@dubbo.apache.org

[GitHub] [incubator-dubbo] beiwei30 commented on issue #3560: [DISCUSS] Dubbo service authorization

["beiwei30 (GitHub)" <gi...@apache.org>]

@Fuyao-JIANG any update on this?

[ Full content available at: https://github.com/apache/incubator-dubbo/issues/3560 ]
This message was relayed via gitbox.apache.org for notifications@dubbo.apache.org

[GitHub] [incubator-dubbo] beiwei30 commented on issue #3560: [DISCUSS] Dubbo service authorization

["beiwei30 (GitHub)" <gi...@apache.org>]

Great, we really need a ACL mechanism for dubbo services. Looking forward to your pull request :)

[ Full content available at: https://github.com/apache/incubator-dubbo/issues/3560 ]
This message was relayed via gitbox.apache.org for notifications@dubbo.apache.org

[GitHub] [incubator-dubbo] Fuyao-JIANG commented on issue #3560: [DISCUSS] Dubbo service authorization

["Fuyao-JIANG (GitHub)" <gi...@apache.org>]

I am sorry that I quit this issue for personal reason. 

[ Full content available at: https://github.com/apache/incubator-dubbo/issues/3560 ]
This message was relayed via gitbox.apache.org for notifications@dubbo.apache.org

[GitHub] [incubator-dubbo] Fuyao-JIANG commented on issue #3560: [DISCUSS] Dubbo service authorization

["Fuyao-JIANG (GitHub)" <gi...@apache.org>]

We plan to use JWT(json web token) to implement authorization.We provide a auth service taking auth information from registry center. And user can set auth rules in a dashboard for auth service. We provide also a filter for consumer to get token from auth service and a provider check token with a filter.
Proceed as follow:
a.Consumer get token from Auth Service when it has no token or token is expire;
b.Auth Service check consumer information and provide token. Token is encrypted by provider's secret;
c.Consumer add token in attachment and send to provider;
d.Provider check token and return response.

[ Full content available at: https://github.com/apache/incubator-dubbo/issues/3560 ]
This message was relayed via gitbox.apache.org for notifications@dubbo.apache.org

[GitHub] [incubator-dubbo] ralf0131 commented on issue #3560: [DISCUSS] Dubbo service authorization

["ralf0131 (GitHub)" <gi...@apache.org>]

Hi, 

+1 to support authorization. 
Do you have any detailed proposal? 


[ Full content available at: https://github.com/apache/incubator-dubbo/issues/3560 ]
This message was relayed via gitbox.apache.org for notifications@dubbo.apache.org