Unify all client/backend communication by letting it go through the client

Description

Acceptance criteria:

  • Client DBus auth API returns localhost instead of the server

  • On this localhost address, client offers an HTTP API which is proxied to the backend

  • Local protocol is plain HTTP

  • The client handles all authentication and mTLS and HW crypto.

  • It is possible to turn the internal auth manager off, so that a different service can provide the connection.

Feature branch: feature-unified_comms

Risk & mitigation

None

Market Goal

None

Attachments

1
100% Done
Loading...

Checklist

Activity

Show:

Lluis CamposNovember 17, 2021 at 7:03 PM
Edited

We have decided to reverse the direction of 3rd party integrations so this epic is mostly de-scoped.

Rejecting tasks , , , , and .

For future reference, the work done so far can be found in:

Kristian AmlieSeptember 28, 2021 at 10:39 AM

We want it to be a drop-in solution which doesn't require any changes to the clients. If we switched to UNIX sockets, all of mender-connect, mender-configure, and mender-monitor would have to change. Besides, it's still speaking HTTP, and we plan to extend it to HTTP proxying later on, so using a network port seems like a natural choice.

There are some advantages to UNIX sockets, such as better control over who can access it. But this isn't needed, because we already use access control on the DBus endpoint to get the JWT token, and without that you cannot do anything with the localhost interface, even if you technically can access the port.

Peter GrzybowskiSeptember 28, 2021 at 10:08 AM

I was not into this a lot, but I have this comment: isn't UNIX socket a better interface than localhost?

Kristian AmlieAugust 31, 2021 at 9:11 AM

Planning done!

I have gone for extremely limited documentation. This is very advanced functionality, which requires implementing whole daemons from scratch. Therefore the only documentation I have included is that you can disable the built-in daemon in . Beyond that, I think we should get comfortable with writing IoT integrations ourselves before we try to steer anyone else in that direction.

eystein.maloy.stenbergAugust 30, 2021 at 5:31 PM

Thank you, indeed it seems like a good idea to start with this next sprint, so let's aim for that!

Unresolved

Details

Assignee

Reporter

Labels

Epic Name

Goals

None

Priority

Backlog

yes

Story Points

Zendesk Support

Checklist

Created August 12, 2021 at 7:23 AM
Updated June 25, 2024 at 12:02 PM