IPDB User Authorization, Monitoring and User Dashboard

[ttmc]

Was bigchaindb/bigchaindb#779

IPDB wants to be able to:

• ignore HTTP requests from unknown users
• revoke HTTP API access by known users (e.g. if they behave badly, or they reach their quota)
• measure who is making the HTTP requests (e.g. for monitoring and billing)

Moreover, IPDB users need a way to:

• get or set authorization credentials/tokens
• see how they are doing, e.g. how many HTTP API requests they've made in the past day, week, month, etc.
• do more in the future

Some kind of IPDB User Dashboard would be nice.

Notes

• this is independent of BigchainDB Server. We shouldn't be modifying BigchainDB Server to accomplish any of the above.
• BigchainDB drivers may require some new extra methods or plugins to make it easier to work with IPDB.

[ttmc]

Rodolphe, Scott, Tim and I had a meeting to discuss our general approach on November 18.

Earlier, Trent had said that it's okay if we start out with a centralized solution. We don't have to decentralize everything right now.

We discussed many approaches but decided to use an API management/gateway solution from a third party for now. My first task was to research the options and try some.

[ttmc]

Here's the list of open source "API Management" solutions I investigated:

• WSO2 API Manager - the big old grand-daddy, Apache2, Java, very enterprise
• Kong by the Mashape folks, Apache2, Lua
• Kong + Wicked, Apache2
• API Umbrella by NREL, MIT license, Lua
• Zuul by Netflix + e.g. Spring Cloud, Apache2, Groovy?
• Tyk, Mozilla Public License 2, Go

I found out after-the-fact that Red Hat plans to make 3scale fully open source some day.

[TimDaub]

@ttmc I think we can close this?

[ttmc]

Yes, thanks. I will close it now.