Mailing-List: contact dev-help@openwhisk.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@openwhisk.apache.org
From: Rodric Rabbah <rodric@gmail.com>
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (1.0)
Date: Thu, 19 Jan 2017 13:44:36 -0500
Subject: Re: Passing security credentials to actions
Message-Id: <83C613A9-17BB-4AE3-84FB-7D7A5A4AF536@gmail.com>
References: <BY2PR0201MB1784B9015B4DD123E9F82006A47E0@BY2PR0201MB1784.namprd02.prod.outlook.com>
In-Reply-To: <BY2PR0201MB1784B9015B4DD123E9F82006A47E0@BY2PR0201MB1784.namprd02.prod.outlook.com>
To: dev@openwhisk.apache.org
archived-at: Thu, 19 Jan 2017 18:44:53 -0000

Dragos as you noted when you create the action (or bind a package containing=
 the action) you can specify the parameters for the action.

Then when the action is composed into the sequence it already has the parame=
ters attached. Those parameters are not visible to other actions in the sequ=
ence (they do not escape the action without one doing it deliberately i.e. r=
eturning a json object containing the secrets from the action).

If you're surfacing the sequence via the API gateway then you've hidden the p=
arameters (I am taking it at face value that final actions have parameters t=
hat may not be overridden at invoke time).

Does this fit your use case?

-r

> On Jan 19, 2017, at 12:02 PM, Dragos Dascalita Haut <ddascal@adobe.com> wr=
ote:
>=20
> I'd like to create an action that communicates with another API. The actio=
n needs a client_id, a secret and/or a keyfile, and/or a private key pair. T=
his is a typical scenario to authenticate a service call; there's an example=
 at [1] describing what needs to be done for such a scenario.
>=20
>=20
> Assumptions :
>=20
> 1. we can't store credentials with the code in Git
>=20
> 2. if the action becomes part of a sequence we might not want the other ac=
tions in that sequence to have access to these credentials. we might want to=
 restrict the credentials to be visible only to the action that needs them.
>=20
>=20
> There are 2 questions here:
>=20
> 1. How can developers associate such metadata (in the lack of a better ter=
m) to the action.
>=20
> 2. How can the action retrieve this metadata.
>=20
>=20
> I'm wondering if there are any thoughts on this already documented or if i=
t's a problem we're yet to solve.
>=20
>=20
> Thanks,
> dragos
> [1] - https://developers.google.com/identity/protocols/OAuth2ServiceAccoun=
t