Skip to content

Commit c65e40e

Browse files
elli-androulakielli-androulaki
committed
FAB-829: App library for access control/App. MSP
This is a changeset including some building blocks for the application (chaincode invoker/chaincode) to prove ownership of certain attributes and the chaincode to certify such ownership proof. The changeset includes also an interface for a server-aided MSP that includes the online registration and enroll process of an entity with the MSP server. Building blocks are based on peermsp for now. Change-Id: Id42a07a14680f7961fd9bb87e54db913ebff30b8 Signed-off-by: Elli Androulaki <[email protected]>
1 parent 01de0e4 commit c65e40e

File tree

2 files changed

+250
-0
lines changed

2 files changed

+250
-0
lines changed

‎appmsp/appmsp.go

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
package appmsp
2+
3+
/*
4+
Copyright IBM Corp. 2016 All Rights Reserved.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
import "github.com/hyperledger/fabric/msp"
20+
import mspconfig "github.com/hyperledger/fabric/protos/msp"
21+
22+
// Membership service provider APIs for Hyperledger Fabric:
23+
//
24+
// By "membership service provider" we refer to an abstract component of the
25+
// system that would provide (anonymous) credentials to clients, and peers for
26+
// them to participate in Hyperledger/fabric network. Clients use these
27+
// credentials to authenticate their transactions, and peers use these credentials
28+
// to authenticate transaction processing results (endorsements). While
29+
// strongly connected to the transaction processing components of the systems,
30+
// this interface aims to have membership services components defined, in such
31+
// a way such that alternate implementations of this can be smoothly plugged in
32+
// without modifying the core of transaction processing components of the system.
33+
//
34+
// This file includes Membership service provider interface that covers the
35+
// needs of an application. This is based on an extension of peerMSP and peerManager
36+
// covering the needs of an application/client.
37+
//
38+
39+
// ApplicationMSPManager is an interface defining a manager of one or more membership
40+
// service providers (MSPs). This essentially acts as a mediator to MSP calls and routes
41+
// MSP related calls to the appropriate MSP.
42+
type ApplicationMSPManager interface {
43+
44+
// Extends PeerMSPManager
45+
msp.MSPManager
46+
47+
// GetMember returns the member object corresponding to the provided identifier
48+
GetMember(identifier MemberIdentifier) (Member, error)
49+
50+
// DeleteMember deletes a specific member object corresponding to the provided
51+
// identifiers
52+
DeleteMember(identifier MemberIdentifier) error
53+
54+
// ImportMember imports a member.
55+
// @param req The import request
56+
ImportMember(req *MemberImportRequest) (Member, error)
57+
}
58+
59+
// ApplicationMSP is the membership service provider interface for application use
60+
type ApplicationMSP interface {
61+
62+
// Extends MSP
63+
msp.MSP
64+
65+
// GetMember returns an already enrolled member,
66+
// or nil if an enrolled member with this name was not found.
67+
// @param name The enrollment name
68+
GetMember(identifier MemberIdentifier) (Member, error)
69+
70+
// DeleteMember deletes a specific member object corresponding to the provided identifier
71+
DeleteMember(identifier MemberIdentifier) (bool, error)
72+
73+
// ImportMember imports a member.
74+
// @param req The import request
75+
ImportMember(req *MemberImportRequest) (Member, error)
76+
}
77+
78+
type MemberImportRequest struct {
79+
// MSPIdentifier to enroll with
80+
MSPIdentifier string
81+
82+
// MemberSigningIdentity includes the long term enrollment identity
83+
// of a member
84+
MemberSigningIdentity *mspconfig.SigningIdentityInfo
85+
}
86+
87+
// Member represents an enrolled entity within an identity provider
88+
type Member interface {
89+
90+
// GetIdentifier returns the member identifier; this naturally includes the
91+
// identifier of the provider this member is a member of.
92+
GetIdentifier() MemberIdentifier
93+
94+
// GetOrganizationUnits returns the organization this member belongs to. In certain
95+
// implementations this could be implemented by certain attributes that
96+
// are publicly associated to that member, or that member's identity.
97+
// E.g., Groups here could refer to the authorities that have signed a
98+
// member's enrollment certificate or registered tse user.
99+
GetOrganizationUnits() string
100+
101+
// GetFabricRole returns the role in the fabric of this member. E.g., if the
102+
// member is a peer, or a client.
103+
// Note: Do we have to have distinction here you think?
104+
GetFabricRole() FabricRole
105+
106+
// GetEnrollmentIdentity returns the enrollment identity of this member.
107+
// The assumption here is that there is only one enrollment identity per
108+
// member.
109+
GetEndrollmentIdentity() msp.SigningIdentity
110+
111+
// GetIdentities returns other identities for use by this member, that comply
112+
// with the specifications passed as arguments.
113+
// @param specs The specifications of the identities that are to be retrieved.
114+
GetIdentities(count int, specs *IdentitySpec) ([]msp.SigningIdentity, error)
115+
116+
// GetAttributes returns all attributes associated with this member
117+
GetAttributes() []string
118+
119+
// DeleteIdentities deletes all identities complying with the specifications passed as parameter
120+
// in this function. This function aims to serve clean up operations, i.e.,
121+
// removing expired identities, or revoked ones(?).
122+
// @param specs The identity specs of the identities to be deleted.
123+
DeleteIdentities(specs *IdentitySpec) error
124+
125+
// RevokeIdentities revokes all identities that comply with the specifications passed as parameter
126+
// in this function.
127+
// @param specs The identity specs of the identities to be deleted.
128+
RevokeIdentities(specs *IdentitySpec) error
129+
}
130+
131+
// IdentitySpec is the interface describing the specifications of the
132+
// identity one wants to recover
133+
type IdentitySpec interface {
134+
// Identity of the identity
135+
GetName() string
136+
137+
// Type indicates whether it is a signing or an Identity
138+
GetType()
139+
140+
// IsAnonymous returns a boolean indicating if the identity is anonymous
141+
IsAnonymous() bool
142+
143+
// A list of attributes this identity includes
144+
GetAttributeList() []msp.Attribute
145+
146+
// Identifier of the identity to recover
147+
GetIdentifier() string
148+
}
149+
150+
// MemberIdentifier uniquely identifies a member naturally
151+
// inheriting the namespace of the associated identity provider.
152+
type MemberIdentifier struct {
153+
// The identifier of the associated identity provider
154+
MSPIdentifier string
155+
// Returns the identifier for a member within a provider
156+
MemberIdentifier string
157+
}

‎appmsp/servermsp.go

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
package appmsp
2+
3+
import "github.com/hyperledger/fabric/msp"
4+
5+
/*
6+
Copyright IBM Corp. 2016 All Rights Reserved.
7+
8+
Licensed under the Apache License, Version 2.0 (the "License");
9+
you may not use this file except in compliance with the License.
10+
You may obtain a copy of the License at
11+
12+
http://www.apache.org/licenses/LICENSE-2.0
13+
14+
Unless required by applicable law or agreed to in writing, software
15+
distributed under the License is distributed on an "AS IS" BASIS,
16+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
See the License for the specific language governing permissions and
18+
limitations under the License.
19+
*/
20+
21+
// ServerEnabledMSP is an interface defining an MSP that leverages a server
22+
// for registration and enrollment. This is an interface that can be used
23+
// in combination to an ApplicationMSP interface or a plain MSP interface
24+
// to add to the related MSP server-aided (online) member/node registration
25+
// and enrollment enablement.
26+
type ServerEnabledMSP interface {
27+
28+
// Register a new member, this is only possible if the member is a registrar
29+
// @param req The registration request
30+
Register(req *RegistrationRequest) (*RegistrationResponse, error)
31+
32+
// Enroll a new member
33+
// @param req The enrollment request
34+
Enroll(req *EnrollmentRequest) (msp.SigningIdentity, error)
35+
36+
// RegisterAndEnroll registers and enrolls a new entity and
37+
// returns a long term signing identity, i.e., the enrollment identity
38+
// @param req The registration request
39+
RegisterAndEnroll(req *RegistrationRequest) (msp.SigningIdentity, error)
40+
}
41+
42+
// RegistrationRequest for a new identity
43+
type RegistrationRequest interface {
44+
// Name is the unique name of the identity
45+
GetName() string
46+
47+
// Get membership service provider type/identifier this request corresponds to
48+
GetProviderType() msp.ProviderType
49+
50+
// Group names to be associated with the identity
51+
GetOrganization() []string
52+
53+
// Type/role of identity being registered (e.g. "peer, app, client")
54+
GetRole() FabricRole
55+
56+
// Attributes to be associated with the identity
57+
GetAttributes() []string
58+
}
59+
60+
// RegistrationResponse is a registration response
61+
type RegistrationResponse struct {
62+
63+
// Returns the username of the registered entity
64+
Username string
65+
66+
// Returns the secret associated to the registered entity
67+
Secret []byte
68+
}
69+
70+
// EnrollmentRequest is a request to enroll a member
71+
type EnrollmentRequest struct {
72+
// The identity name to enroll
73+
Name string
74+
75+
// Some information to authenticate end-user to the enrollment
76+
// authority
77+
AuthenticationInfo []byte
78+
}
79+
80+
// EnrollmentResponse is a response to enrollment request
81+
type EnrollmentResponse struct {
82+
// The enrollment certificate
83+
IdentityBytes []byte
84+
}
85+
86+
/* Member roles indicates the role of the member in the fabric infrastructure */
87+
type FabricRole int
88+
89+
const (
90+
PEER FabricRole = iota // member is a peer
91+
CLIENT // member is a client
92+
REGISTRAR // member is a registrar (part of app)
93+
)

0 commit comments

Comments
 (0)