Changes

First, a few definitions. The major players in the network topology are:

 Cryptographically, we have the following terms: * '''HKDF''': HMAC-based Key Derivation Function, a method for deriving multiple secret keys from a single master secret (https://tools.ietf.org/html/rfc5869).* '''Two-Legged OAuth''': an authentication scheme for HTTP requests, based on a HMAC signature over the request metadata. (http://tools.ietf.org/html/rfc5849#section-3)* '''Auth Token''': used to identify the user after starting a session. Contains the user application id and the expiration date.* '''Metadata Token''': used to send application-specific metadata for the Service.* '''Master Secret''': the a secret shared between Login Server and Service Node. Never used directly, only for deriving other secrets.

# the client trades a browser id assertion for a session an auth tokenand corresponding secret# the client turns uses the session auth token into a to sign subsequent requests using two-legged oauth token

Getting a session an auth token:

create signed auth header [7] | | call node --------------- [8] ---|---------------->|--> verify token [9] | | verify request signature [10] | |<-- process request [911]

* the client request requests a token, giving its browser id assertion [1]

* the Login Server creates a response with a session an auth token and corresponding token secret [5], using and sends it back to the user. The auth token contains the user id, a time stamp and a secret string only known by the selected node and itselftimestamp, and sends it back to is signed using the user along with a signing secret. The token secret is derived from the shared master secret, and auth token using HKDF (https://tools.ietf.org/html/rfc5869). It also adds the node url in the response, and optionaly a metadata token. [6]

{'oauth_consumer_key': <auth-token>, 'oauth_consumer_secret': <derivedtoken-secret>,

* the client calculates with the information received, an OAuth authorization header, and saves the node locationand oauth parameters to use in subsequent requests. [6]* for each subsequent request to the client calls the right nodeService, using the client calculates a special Authorization header. It tramsmits asusing two-is legged OAuth [7] and sends the request to the token and allocated node location [8] along with the metadata token if provided [7]

oauth_tokenoauth_consumer_key="kkk9d7dh3k39sjv7",<auth-token>

* the node is able with its shared secret uses the Signing Secret to validate that the request is valid, by calculating Auth Token [9]. If invalid or expired then the node returns a 401* the node calculates the derived key given Token Secret from its Master Secret and the salt Auth Token, and checks whether the signature in the shared secret Authorization header is valid [910]. If it's an invalid or expired token, then the node returns a 401* the node processes the request as defined by the Service [11]

A token is a json encoded mapping. They The are two tokens:

The token is signed using the salted derived signing secret and base64-ed. The signature is HMAC-SHA1:

auth_token, signature = HMAC-SHA1(auth_token, secret_keysig_secret)