SEPTENTRIO PolaRx5TR, Reference Manual

Page: 44 / 512

1 How To...
1.24 CloudIt Workflow (beta)
CloudIt is a beta feature. The instructions in this “How to“ section are subject to changes.
1.24.1 Introduction
CloudIt offers an alternative to FTP log file submission from the PolaRx5TR receivers. CloudIt
supports OAuth2 for authentication. The implementation is compliant with the specification
of “The OAuth 2.0 Authorization Framework“.
Note that CloudIt only supports the “Authorization Code“ grant to comply with the security
requirements and the authorization process for third party applications.
1.24.2 Server Setup
CloudIt expects the user to set up two servers, an authentication server and a resource
server. The authentication server is used to verify if the receiver running CloudIt can access
the resource server. The resource server stores the data files from the receiver.
In this section, the difference between the authentication and resource servers is used to-
wards the network administrator. However inside the receiver configuration, this difference
is invisible to the end user, as both the authentication and resource servers are, on the re-
ceiver, one Cloudit
Server
, such as in the
setCloudItConfig
command.
1.24.2.1 Authentication Server Setup
Keycloack is recommended as an Identity and Access Management platform for the authenti-
cation server, as CloudIt has been tested and validated using this tool (Keycloack.4.5.0). Other
Access Management platforms were not tested but can offer similar possibilities. However,
since most other tools offer more specific and/or proprietary implementations of the OAuth2
protocol, CloudIt might not (yet) be compatible with these.
Inside the authentication server it is required to create an application. At this level it should
be possible to get a
ClientID
and a
ClientSecret
and to define the
Scope
. The
Scope
should, as
an example, include the permission to write on your resource server.
The Access Management platform also provides the Authentication URL (identified in the
receiver as
AuthURL
) and Token URL (identified in the receiver as
TokenURL
). The exact proce-
dure on how to get this information depends on the Access Management platform setup.
These arguments will be used to configure CloudIt using
setCloudItConfig
.
Currently, CloudIt only supports the stateless access/refresh token authorization process.
If the authorization server does not respond with both the access and refresh tokens, the
authorization will fail.
The authorization server should be configured to accept authorization requests without a
redirect_uri. However, the server will need to redirect all successful authorization requests
44