4 - Authentication

So far we've been testing the server using simple routes.

If we run proper transactions through DATP it will need to know that the user calling the route has been authenticated, and will need to know who the user is so it can control access.

There are many ways this can be implemented, such as using Tooltwist's Loginservice, AWS API Gateway, IBM's APIC and others. A specific approach will often be mandated by the deployment framework chosen, and is outside the scope of DATP, so DATP allows application the ability to ensure these checks have been done, and add information to the request object to specify the "tenant" calling the server.

A simple authentication

During development, we don't usually need to worry about the current tenant, so we can use middleware that hard codes the tenantId. Traditionally we use the tenantId "acme" during testing.

Your mission

Open COURSE-FILES/2.4-authentication/app.js using Open to the Side and copy the code changes to your app.js.

The changes are:

• We add a middleware function that hard-codes req.tenant to an object containing a tenantId.

• Tell restify to use this middleware, with server.use().

• As an extra tweak, we'll update the message displayed after the server starts, to include the nodeId. This will be useful in future exercises.

Save app.js once you have made these changes, and your server should restart with the authentication middleware operational.

Authenticating Admin functions

IMPORTANT!!

The MONDAT utility uses API routes in the DATP server that provide super-user access. It is essential that your authentication front end restricts access to all routes that match the path /mondat/*.

Typically this is done by white listing the IP addresses that may access this URL pattern.

Run the test again

Now that we have authentication middleware working, return to MONDAT and run your myPipeline test again. You should now get a successful return from your transaction.

{
  "metadata": {
    "owner": "acme",
    "txId": "tx-e3cd29cb633f514b0a49ecdf81e2afd54bafaff6",
    "externalId": null,
    "transactionType": "myPipeline",
    "status": "success",
    "completionTime": 1683737949326,
    "lastUpdated": 1683737949326,
    "notifiedTime": null
  },
  "progressReport": null,
  "data": {
    "message": "Have a nice day"
  }
}

Note that the data section contains the message you specified in youe pipeline.

Click on the various tabs in MONDAT to see the information DATP records about the transaction.

Next...

In the next section we create our own step, so it can be placed into pipelines.

---