Design: Security Concept about juicemachineservice

[MBeuttler]

How are machines authorized and authenticated?

• We will use a two way oAuth process
• As external oAuth provider google, facebook and some more will be supported.
• As addition we will provide a own oAuth provider service, that will give the possibility to register and login with an "IUNO" Account directly on the marketplace.
• After a user has logged in with an external oAuth provider, we link this account to an internal user database.
• Internaly we use a seperated oAuth Service, that manages internal access tokens for users and resources.
• When ever a internal server like the JuiceMachineWebsite want's to access resources an the MarketplaceCore, he has to retrieve a access token from the internal oAuthService first.
• Within the oAuthService we will define scopes managing the access right for users and resources.
• The MarketplaceCore will check those scopes first, before accessing the database or starting a process.
• The last layer of security will be set on the database. Here we will bin resources and right to user ids.

---

1. The scopes of the oAuth Service define, what rights a service were given by a user to access a resource.
2. The database security defines, what resource belong to what user and who can actually access them