# PantherX User Identity Service

- Provides signed response from `px-device-identity` via REST API
- runs on `127.0.0.1:8010`

## Setup

### Setup on PantherX

- (1) Setup, and register your device with `px-device-identity`
- (2) Add service to system configuration

```scheme
(service px-user-identity-service-type)
```

### Install with pip package manager

_Install this packages as root; Minimum python version: v3.8+_

```bash
pip3 install https://source-git-pantherx-org.s3.eu-central-1.amazonaws.com/px-user-identity-service_latest.tgz
```

**Important**

1. This package depends on `px-device-identity`. It's included in the package.
2. This computer should be registered using `px-device-identity` before running `px-user-identity-service`

## Run

This service only runs under `root`.

```bash
px-user-identity-service
```

Params:

```bash
-p, --port: Port to run the service on
-kd, --key-dir: Directory to store keys
-cd, --config-dir: Directory to store config
-d, --debug: Run in debug mode
```

For development against Docker, roughly like this:

```bash
px-user-identity-service -kd /home/franz/git/ones-idp/.identity-service/keys -cd /home/franz/git/ones-idp/.identity-service/config
# python3 -m px_user_identity_service.main -kd /home/franz/git/ones-idp/.identity-service/keys -cd /home/franz/git/ones-idp/.identity-service/config
```

### Run as Service

- PantherX OS: `herd start px-user-identity`
- systemd based distributions like Debian, Centos, use the service from [here](docs/systemd-service.md)

## Use Rest API

### QR Authentication

WORK IN PROGRESS

### BC Authentication

To request a BC authentication, post the username like to:

```bash
$ curl -X POST -H "Content-Type: application/json" \
-d '{"login_hint": "master.user@pantherx.org", "login_message": "Authorize login to Ones", "resource": "http://localhost:8008"}' \
http://localhost:8010/auth/bc

## PENDING
{"auth_req_id":"Ev2GDedXbzRG4Rma6hldvk95gLMGUQzOzzOBR2C2pMB","expires_in":600}
```

Alternatively, you may define the required scope:

- `openid` is mandatory
- `offline_access` to receive a refresh token
- `contact` and `profile` are optional

```bash
$ curl -X POST -H "Content-Type: application/json" \
-d '{"login_hint": "master.user@pantherx.org", "login_message": "Authorize login to OnesPHR", "scope": "openid offline_access contact profile"}, "resource": "http://localhost:8008"}' \
http://localhost:8010/auth/bc

## PENDING
{"auth_req_id":"Ev2GDedXbzRG4Rma6hldvk95gLMGUQzOzzOBR2C2pMB","expires_in":600}
```

To request the BC login status do:

```bash
$ curl http://localhost:8010/auth/bc/Ev2GDedXbzRG4Rma6hldvk95gLMGUQzOzzOBR2C2pMB

## PENDING
{"message":"authorization request is still pending as the end-user hasn't yet completed the user interaction steps","status":"pending"}

## EXPIRED
{"message":"backchannel authentication request is expired","status":"expired"}

## SUCCESS
{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6ImF0K2p3dCIsImtpZCI6IlhWbHU1OTdTbnNqaVJJak90QmtYM3E2S1hoZ2cySDVRY2p3aFNQWC1EQWcifQ.eyJpZHBfcm9sZSI6Im1hc3RlciIsInVzZXJuYW1lIjoibWFzdGVyLnVzZXJAcGFudGhlcngub3JnIiwibWF0cml4X2lkIjoiQG1hc3Rlci51c2VyOmxvY2FsLmRldiIsImp0aSI6Im1pQVFFT2d5dTFyWTZNS0RRMzZEUSIsInN1YiI6IjUyZTI0MzY2LTBlMWQtNGVkMy1iNmFhLTcwYTExNWE3ZTY0NyIsImlhdCI6MTczNzA0NzY3NCwiZXhwIjoxNzM3MDU0ODc0LCJjbGllbnRfaWQiOiJiYWQxYjdiOS02ZTBiLTQ4OWYtYWM0OS0xMzI2MDMwZjQzOWMiLCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjQwMDAvb2lkYyIsImF1ZCI6IjU1ZTU1YWQ2LTQxNDQtNDk1MS1iNzMzLWI0ZTgwNTg5YTZiNiJ9.AToGNbTyrMLi-H01lQ838zXm7wbD0DZWd3LhW41Bh7mFIj26EMjEjIm9wjT6NOM536kb2seQYNbVJAMDSlVDYU5WIFbbv5YIhdIt3T3qQGhBiV2YfdoNmTaa5ca5AZhJulxHaOcmmcNLZfOOPz2pMve_qxe7wmVyi_FSMCRxJFKQG76Q4Hp78vIBLBWg0tLVaJI2KSzXSrg2-BuQW6kotzejeWo2CGE4X_zGHU_o-rtZJR_HJBzvZf-1b7Fs3m_T0giGB3z8P1QyNSI3sWYpdd3fMLpxN_eT9R52fredWbThIFuGkaWSQvf9GCbA2eW4FFqdPJBbBBrvXxeoVqcQ4w","expires_in":7200,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IlhWbHU1OTdTbnNqaVJJak90QmtYM3E2S1hoZ2cySDVRY2p3aFNQWC1EQWcifQ. .2RkREWIo_nVp_jCaPtrGy7e52OPRycK6xaLBMCnXGrAxsyhsTpYG-WSSrE7RyEdUidRb0wW0_impx1lf-SMqc4y2YsAUwJSVOkCiQCUKKFeRkR-H8Hu7uCZ_zy1ZchBKN6iLXl-BNwDYGcNBFyoF_KlkGCmPKUSNaLuB8GSRolGXaBJfMqTKC-ksHi8Z8VO95KbWyDrIe7ikY8yFaTVe9YMNi36qxB-eSfbDaokwa4cNvurZRi20yvpgG2RpE5NnskEOcUnX28MlIWQm4mcrJwHsraMgkmvMtYm0dz2QA2yuxOz57gcR_SF6TILIjoNDvOPxjrKDyyKmtn4lVzDGLw","scope":"","token_type":"Bearer"}
```

### LEGACY QR Authentication

To request a QR authentication grant do:

```bash
$ curl http://localhost:8010/auth/qr
{"auth_req_id":"d8596541-c1ff-4377-80bf-d7bca136f024","exp":300}
```

Next: Generate a QR code from `{ auth_req_id: '...', deviceId: '...' }`

To request a QR authentication grant status do:

```bash
$ curl http://localhost:8010/auth/qr/b7249f0d-4cd9-48d7-8249-82459cd46e3c

## PENDING
{"deviceId":"04395db9-b148-4f39-a71b-98d0ebfd6092","status":"pending"}

## SUCCESS
{"access_token":"IuBgmi2oglcWgQB-mg8a14bBex_RCGD7QPybZb6tWqX","deviceId":"04395db9-b148-4f39-a71b-98d0ebfd6092","expire_at":1736157311,"issue_time":1736155511,"refresh_token":"UOO-zBbDzOed5SZhLJtMaE_oOtEoi2sIwDDAhdUtrym","status":"approved"}
```

Next: Once the login has been approved, this response will contain the user `access_token`.

### Refresh Session

If you have a access token, it's easy to refresh the session:

```bash
$ curl -X POST -H "Content-Type: application/json" \
-d '{"access_token": "r7yn8oyCG3BTxe8GcGnTR1HhTboOusa4_INkjgTs6UV", "refresh_token": "UYJ8_lvjGbil9WWGqC65BaXkiexRN0ope1B2l4ocj_y"}' \
http://localhost:8010/auth/refresh

{"access_token":"PgRTtIPOOI9MzFvbqTV3HY0iRY1ZuoBo6Xslj-o8206","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IlhWbHU1OTdTbnNqaVJJak90QmtYM3E2S1hoZ2cySDVRY2p3aFNQWC1EQWcifQ.eyJzdWIiOiI1MmUyNDM2Ni0wZTFkLTRlZDMtYjZhYS03MGExMTVhN2U2NDciLCJhdF9oYXNoIjoiVFVtTGtIcV81UHJLU1l2WTVhaEo5USIsImF1ZCI6ImJhZDFiN2I5LTZlMGItNDg5Zi1hYzQ5LTEzMjYwMzBmNDM5YyIsImV4cCI6MTczNjE1OTc3MiwiaWF0IjoxNzM2MTU2MTcyLCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjQwMDAvb2lkYyJ9.58CxXArBS1Dc0O0tVtAtho8hyYEq9Z1Yz3NfoMuHfYcPabOJ1oiVbNRyxPlnudIGYD6xPk7reZxm1SOUkyx-4nTsKC5Mo3SE6oICORXBVVGC6lh2XhrrDAsbXPQ6mfP1GkQ722R4-HWzL3_MkIqy9muHHv98T1YgZuqftU3zg8AKutju-5SIEK2wQqX1FtvF5AmCrpKNdeflXFaobNf_g-iUC24z6ZHT2URWhwJfU877iAuPkevp0w_vIpZgw44TnaFrMfJqdlBGSonaoTYLcMC7Wxg-ajVSpYSsEfXge_vf-n722JnxY1Yp5DueQN11osq2D-5W5JHE6QW3RQIwkg","refresh_token":"S3o33SE-PfxSrzqIdnybhbCpkjrFpNxzkaO7s2d7VqP","scope":"offline_access openid contact profile","token_type":"Bearer"}
```

## Use as Library

_Note that this is only useful for applications intended to be run under `root`._

### LEGACY QR Authentication

```python
from px_user_identity_service import QRAuthentication
qr = QRAuthentication()
# LOGIN
login_res = qr.login()
# Status
status_res = qr.status(login_res['auth_req_id])
```

### BC Authentication

```python
from px_user_identity_service import CIBAAuthentication
ciba = CIBAAuthentication()
# LOGIN
login_res = ciba.login(login_hint_token, login_message)
# Status
status_res = ciba.status(login_res['auth_req_id])
```

### Common Authentication (Refresh)

```python
from px_user_identity_service import CommonAuthentication
auth = CommonAuthentication()
# Refresh
res = auth.refresh('Bbx0DloRlM4Khk1FCn7CVrXEHcFtC1ccoJUB1gDnEOp')
```

## Troubleshooting

Find logs at `/var/log/`

## Development

Create a guix / python environment like so:

```bash
# system dependencies
guix shell --pure --check python tpm2-tss tpm2-tss-engine

# python dependencies
python3 -m venv venv
source venv/bin/activate
pip3 install .
```
