3

I've put in security my Orion (as backend by using Keycloak and Kong), and now I can manage entities and subscriptions through authentication (token).

My question now is how can I also put the notifications (of subscription) in security?

In other words, how can my server trust about of the notification payload sent by Orion? I was thinking of using the custom notification or adopting HTTPS. Could you address me on the right solution? Thanks a lot.

pasquy73
  • 563
  • 3
  • 13

2 Answers2

3

By default, Orion propagates the fiware-service, fiware-servicepath and x-auth-token headers in any given update requests to any notification triggered by such given update.

If that mechanism doesn't suffices, your idea of using custom notifications to add other notification headers (or URL query parameters or whatever used by your notification receiver to authenticate) is valid. You may find interesting the example included in this documentation section which shows how to use custom notification to add an Authorization header.

fgalan
  • 11,732
  • 9
  • 46
  • 89
  • 1
    Thank you. It worked. I'm using the Update Entity (within my fiware header and the x-auth-token) and I can get in the notification the x-auth-token header. – pasquy73 Dec 20 '22 at 11:45
  • If you find my answer ok, please tick it as valid. It is not to feed my ego :) but for helping other people showing it is a correct solution to the issue. – fgalan Dec 20 '22 at 14:37
1

The token thing is not very robust as a token might have already be revoked or outdated when the notification comes through.

Ideally Orion should authenticate itself against your Webhook when notifying data. Also it should verify the TLS connection so that it matches the one registered when creating the subscription. Mutual TLS would be ideal.

It could also sign the notification payloads so that you can verify its authenticity.

Jose Manuel Cantera
  • 853
  • 4
  • 4
  • 2
    Thank you Jose, do you have some example or configuration? – pasquy73 Dec 20 '22 at 15:46
  • 1
    I would like to try to sign the Orion notification payload (as Jose Manuel Cantera suggested). I'm looking for it in the documentation, but I didn't find an example or workaround. Could you suggest to me how to do it? Thanks – pasquy73 Jan 11 '23 at 08:09