rsa-bearer-auth

RSA based Bearer authentication system for node.js.

Prerequisites

• Unix system
• OpenSSH
• io.js >=2.0.2
• Redis

Why?

This module works awesome when we have to authenticate an user via a node.js command line application. In particular suppose you have an npm module for uploading stuff on you server via a command line (like npm add and npm publish for example). Using rsa-bearer-auth you can avoid a classic username/passowrd authentication using RSA keys instead.

Usage

The module comes with a Server and a Client object.

The server mainly listens for ssh connection from one side and it exposes an HTTP JSON API from the other side.

The ssh server is simply used to exchange the client private key with the server and it allows the server to perform a private/public key match. In case of success, a JSON WEB TOKEN is generated. No private key are stored on the server.

Client.getToken(cb) can be used to get a valid token. The client use the local ssh agent to perform an ssh connection with the server using the user RSA key for the authentication. For this reason the user public key must be uploaded on server using the HTTP API. Every user can have more then one key. Keys are stored into Redis.

Client.verifyToken(token, cb) can be used to verify a token.

Check out examples basic-server.js and basic-client.js to understand how it works and how to use.

Does it work on Windows?

I don't know.

TODO

• Validation
• Implement Client.addKey(key, user, cb) and Client.delKey(key, cb)
• Writing better documentation
• Creating real demo example