{"action":"closed","issue":{"url":"https://api.github.com/repos/subutai-io/base/issues/621","repository_url":"https://api.github.com/repos/subutai-io/base","labels_url":"https://api.github.com/repos/subutai-io/base/issues/621/labels{/name}","comments_url":"https://api.github.com/repos/subutai-io/base/issues/621/comments","events_url":"https://api.github.com/repos/subutai-io/base/issues/621/events","html_url":"https://github.com/subutai-io/base/issues/621","id":146114664,"number":621,"title":"Password-less Hub trust based authentication to third party peer","user":{"login":"akarasulu","id":10051386,"avatar_url":"https://avatars.githubusercontent.com/u/10051386?v=3","gravatar_id":"","url":"https://api.github.com/users/akarasulu","html_url":"https://github.com/akarasulu","followers_url":"https://api.github.com/users/akarasulu/followers","following_url":"https://api.github.com/users/akarasulu/following{/other_user}","gists_url":"https://api.github.com/users/akarasulu/gists{/gist_id}","starred_url":"https://api.github.com/users/akarasulu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akarasulu/subscriptions","organizations_url":"https://api.github.com/users/akarasulu/orgs","repos_url":"https://api.github.com/users/akarasulu/repos","events_url":"https://api.github.com/users/akarasulu/events{/privacy}","received_events_url":"https://api.github.com/users/akarasulu/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/subutai-io/base/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":{"login":"nk-the-crazy","id":11713346,"avatar_url":"https://avatars.githubusercontent.com/u/11713346?v=3","gravatar_id":"","url":"https://api.github.com/users/nk-the-crazy","html_url":"https://github.com/nk-the-crazy","followers_url":"https://api.github.com/users/nk-the-crazy/followers","following_url":"https://api.github.com/users/nk-the-crazy/following{/other_user}","gists_url":"https://api.github.com/users/nk-the-crazy/gists{/gist_id}","starred_url":"https://api.github.com/users/nk-the-crazy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nk-the-crazy/subscriptions","organizations_url":"https://api.github.com/users/nk-the-crazy/orgs","repos_url":"https://api.github.com/users/nk-the-crazy/repos","events_url":"https://api.github.com/users/nk-the-crazy/events{/privacy}","received_events_url":"https://api.github.com/users/nk-the-crazy/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/subutai-io/base/milestones/2","html_url":"https://github.com/subutai-io/base/milestones/4.0.0-RC10","labels_url":"https://api.github.com/repos/subutai-io/base/milestones/2/labels","id":1711896,"number":2,"title":"4.0.0-RC10","description":"","creator":{"login":"akarasulu","id":10051386,"avatar_url":"https://avatars.githubusercontent.com/u/10051386?v=3","gravatar_id":"","url":"https://api.github.com/users/akarasulu","html_url":"https://github.com/akarasulu","followers_url":"https://api.github.com/users/akarasulu/followers","following_url":"https://api.github.com/users/akarasulu/following{/other_user}","gists_url":"https://api.github.com/users/akarasulu/gists{/gist_id}","starred_url":"https://api.github.com/users/akarasulu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akarasulu/subscriptions","organizations_url":"https://api.github.com/users/akarasulu/orgs","repos_url":"https://api.github.com/users/akarasulu/repos","events_url":"https://api.github.com/users/akarasulu/events{/privacy}","received_events_url":"https://api.github.com/users/akarasulu/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":8,"state":"closed","created_at":"2016-04-17T05:35:30Z","updated_at":"2016-06-02T05:34:11Z","due_on":"2016-04-27T04:00:00Z","closed_at":"2016-04-27T13:21:56Z"},"comments":1,"created_at":"2016-04-05T21:50:31Z","updated_at":"2016-06-02T05:34:11Z","closed_at":"2016-06-02T05:34:11Z","body":"Right now the Hub is being authorized by the SS peer (when registered with the Hub) to create a user account. This account is created to establish the environment owner on the console of someone else's peer so they may view and administer their environments on it. \r\n\r\nYou can see the user identity that is being created on OPPs here:\r\n\r\n![screen shot 2016-04-05 at 5 38 34 pm](https://cloud.githubusercontent.com/assets/10051386/14298894/64cc7026-fb55-11e5-9f19-8872dfada929.png)\r\n\r\nThis decreases usability, bypasses the entire point of having the e2e plugin and our advanced security model and potentially creates a security hole. It's much better to simply create a trust chain from the peer and its owner to the owner of the environment through their mutual hub trust like so:\r\n\r\n[peer owner id] ---owner---> [peer id] ---trust---> [hub id] ---trust---> [member id] ---owner---> [env id]\r\n\r\nAt the end, the net result should be to authenticate onto the SS console without a password using your Hub account based on this trust chain. The login screen combined with the browser plugin should work together to ask if you want to login as a user defined in the browser plugin. \r\n\r\nNotes:\r\n\r\n* The peer owner and their registered peers trust the hub, perhaps each peer that is setup as public or shared can have different kinds of trust authorizations\r\n   * sharing with friends statically causes direct trusts between the peer id and hub member id\r\n   * public access for dynamic use causes transitive trusts that go through the hub id \r\n* The hub trusts the environment owner who owns their environment to manage it\r\n* The hub id must be setup and this key pair must be protected\r\n* This need represents the first big integration step using the security model of SS with the Hub and should be done properly\r\n"}}
{"actor":{"display_login":"nk-the-crazy"}}