How to send additional data to Themis

[schmidtw]

We have some use cases where Themis needs more information than is presently being passed in the HTTP headers.

Parodus code calling Themis:
https://github.com/xmidt-org/parodus/blob/master/src/auth_token.c#L81

Parodus code building convey:
https://github.com/xmidt-org/parodus/blob/master/src/ParodusInternal.c#L36

While the convey header has the collection of this data, the pattern Themis has taken is to split the headers out into their own vs. bundling them into a single header.

Should we drop the convey (base64 encoded JSON) pattern in favor of individual headers?

Given the data I have today, I'd favor moving away from the convey header for the following reason:

1. Base64 encoded JSON is fairly large vs. the volume of data passed
2. Several fields are already modeled as HTTP headers
3. No changes are needed to Themis regarding decoding the fields
4. We leverage the HTTP spec more

Thoughts?

[mkaupp]

Hello Weston,
in addition to what you described, the change on Parodus has to be reflected in Themis
https://github.com/xmidt-org/themis/blob/1f34e4ad7c5fb8b92be52677aa012f4659c719a7/themis.yaml#L79

IMHO individual headers would support maintainability - changes would apply to one concrete component.

[schmidtw]

I've put a PR together against parodus so that once we get the ok, we can merge it or reject it.
xmidt-org/parodus#361

[sadhyama]

Hi Wes,
Yes, individual header is better than convey approach and changes in PR looks good.

Would like to know what are the exact use cases of themis with the new headers ?

Thanks.

[johnabass]

I think this affects the XMiDT servers. talaria keeps the convey information around as part of device state. We'll need to update our code to parse the relevant, individual headers.

Should we file separate issues against talaria and themis for this?

[schmidtw]

This should only affect the call to themis unless we want to make a change to the URL used for talaria.

Looking at the link @mkaupp posted & searching through the code, it looks like consuming the additional headers is configurable in themis and requires no code change. Did I miss something @johnabass ?

[johnabass]

Yes, consuming additional headers is just a configuration tweak to themis. It will add those headers as JWT claims.

I think I misread the OP as removing the convey functionality entirely for XMiDT. It sounds like this is just not introducing it to themis, which is perfectly fine.

[schmidtw]

Thanks for the great feedback. I've merged xmidt-org/parodus#361. I'm going to update the build/make and perform a release.