Protecting resources on Node.js servers

The options parameter contains one or more of the following options:

• publicKeyServerUrl: (Mandatory) Specifies the URL of the MobileFirst Server from which the public key is retrieved to verify the tokens.
  Note: Alternatively, you can pass the public key server URL as a parameter to the passport.authenticate method. This method is used in the Example.)
• scope: Space-separated string to define the list of realm names that are required for accessing the resource. If no scope is specified, only the mandatory scope is checked in the token.
  Note: Alternatively, you can pass the scope as a parameter to the passport.authenticate method. (See Example.)
• cacheSize: The maximum number of tokens allowed. The default value is 500.
• logger: Defines a logger instance. The default value is the IBM® default logger, which outputs log messages to the console.
• analytics.onpremise: Use this parameter to specify where to send the analytics logs. Logs are displayed in the MobileFirst Operational Analytics console.
  • url: The url that specifies the location of the operational analytics server. For example, http://localhost:10080/worklight-analytics-service/data.
  • username: The user name if credentials are required.
  • password: The password if credentials are required.
  For more information about operational analytics, see Operational analytics.

The following example shows how to use mfpStrategy in a node application:

var express = require('express'),
    passport = require('passport-mfp-token-validation').Passport,
    mfpStrategy = require('passport-mfp-token-validation').Strategy;
    //the configuration ('config') is optional if you wish to report
    //events to the Analytics Server.
    var config = {
    		url : 'http://localhost:10080/worklight-analytics-service/data',
    		username : 'admin',
    		password : 'admin'
    };

    passport.use(new mfpStrategy({publicKeyServerUrl:'http://localhost:10080/WLProject',
    analytics : {onpremise: config}}));

    var app = express();
    app.use(passport.initialize());

    // protect API with mfpStrategy using scope Realm1 Realm2 Realm3 
    		app.get('/v1/apps/:appid/service', passport.authenticate('mobilefirst-strategy',
           {session: false , scope: 'Realm1 Realm2 Realm3' }),
        function(req, res){
               res.send(200, req.securityContext);
			     }
		   );

     app.listen(3000);

To start the example, issue the following commands:

  $ npm install express
  $ npm install passport
  $ npm install passport-mfp-token-validation

The passport-mfp-token-validation module verifies the authorization header of the request. The authorization header consists of the following elements:

Bearer Access_token ID_token

Bearer

(Mandatory) Is the required string for the token type, as defined in the OAuth 2.0 specification.

Access_token

(Mandatory) Encapsulates all of the security checks that the client has passed in the authorization phase.

ID_token

(Optional) Contains information about the user and device identity of the client.