How will developers request MozLDAP app id and app key?
What information will be required?

Who will say yes or no?

Who will manage these keys?

Mozilla websites which consume the MozLDAP web services should do so in a secure manner.

1. They should be done of https

2. They should sign their requests

3. MozLDAP should verify request signatures, before servicing a request.

Each webapp would have to register the following:

AppID: socorro-123456
Secret: somereallylongsecretwhichwasautogenterated

(I need to play with the real APIs more, bear with me)

If the signature is valid, continue servicing the request. Otherwise respond with a 401 or other relevant HTTP code.

Benefits - Operations can lock down who can use mozLDAP. They can change secret AppIDs and Secret keys as needed.

(Updated: removed my original proposal as HAWK is a better idea)

Althought MozLDAP is currently awesome the way Swiss Army knives are awesome, for 1.0, I think it should have a small, focused API.

This API should meet the 80% case of many Mozilla community and internal websites. Effectively this is:

• Is this email address currently a valid employee
• Is this email address a member of LDAP group X

These two API calls could be organized under authorization.

The 1.0 release would be MozLDAP Authorization APIs.

The other features of this repo should be moved into a different branch or deleted. This is needed for security reasons, so that the surface area is small.

Each of these APIs would return a boolean.

These APIs can only be consumed by registered applications as noted in Issue #1.

FYI: The following changes were made to this repository's wiki:

• defacing spam has been removed

• the wiki has been disabled, as it was not used

These were made as the result of a recent automated defacement of publically writeable wikis.