Ticket

An authentication ticket is a signed (and possibly encrypted) assertion of a user's identity, that a client can use to authenticate the user without the need to ask it to re-enter its credentials.

Description

A session can issue a ticket only when it was opened with an authentication method listed in security.ticket.authmethods. That list cannot contain anonymous or oauth2.

Claims

idstringIMMUTABLE

The unique identifier for the ticket

issued_bystringIMMUTABLE

Identifies the principal that issued the ticket. Most of the time this is an application identifier (a.k.a username or client_id) but sometimes it can be the WAMP session's username (a.k.a authid).

authidstringIMMUTABLE

identifies the principal that is the subject of the ticket. This is the WAMP session's username (a.k.a `authid').

authrolesarray[undefined]IMMUTABLE

Present only on a role-restricted ticket: the subset of the issuer's roles a session authenticated with this ticket gets, non-negotiably. Absent means unrestricted.

authrealmstringIMMUTABLE

Identifies the recipients that the ticket is intended for. The value is a realm URI.

expires_atintegerIMMUTABLE

The expiration time, in seconds since the Unix epoch. Bondy rejects the ticket on or after this time. Bondy allows a leeway of 2 minutes by default.

issued_atintegerIMMUTABLE

Identifies the time at which the ticket was issued. This claim can be used to determine the age of the ticket. Its value is a timestamp in seconds.

issued_onstringIMMUTABLE

The Bondy nodename in which the ticket was issued.

scopeobjectIMMUTABLECOMPUTED

The scope of the ticket.

realmuriIMMUTABLE

If all, the ticket grants access to all realms the user has access to through the authrealm (an SSO realm). Otherwise, the value is the realm this ticket is valid on.

client_idstringIMMUTABLE

device_idstringIMMUTABLE

Ticket Scopes

A ticket can be issued using different scopes. The scope is determined based on the options used to issue the ticket.

Local scope

The ticket can be used to authenticate on the session's realm only.

This is the most common scope and probably the only one you will need.

The ticket was issued with allow_sso option set to false or when set to true the user did not have SSO credentials, and the option client_ticket was not provided.

Authorization

To issue this ticket, the session needs the permission bondy.issue on the bondy.ticket.scope.local resource.

SSO Scope

The ticket can be used to authenticate on any realm the user has access > to through SSO.

The ticket was issued with allow_sso option set to true and the user has SSO credentials, and the option client_ticket was not provided.

Authorization

To issue this ticket, the session needs the permission bondy.issue on the bondy.ticket.scope.sso resource.

Client-Local scope

The ticket can be used to authenticate on the session's realm only.

The ticket was issued with allow_sso option set to false or when set to true the user did not have SSO credentials, and the option client_ticket was provided having a valid ticket issued by a client (a local or sso ticket).

Authorization

To issue this ticket, the session needs the permission bondy.issue on the bondy.ticket.scope.client_local resource.

Client-SSO scope

The ticket can be used to authenticate on any realm the user has access to through SSO.

The ticket was issued with allow_sso option set to true and the user has SSO credentials, and the option client_ticket was provided having a valid ticket issued by a client ( a local or sso ticket).

Authorization

To issue this ticket, the session needs the permission bondy.issue on the bondy.ticket.scope.client_sso resource.

Scope Summary

• uri() in the following table refers to the scope realm (not the Authentication realm which is used in the prefix)

Permissions Summary

Issuing tickets requires the user to be granted certain permissions beyond the WAMP permission required to call the procedures.

Scope	Permission	Resource
Local	bondy.issue	bondy.ticket.scope.local
SSO	bondy.issue	bondy.ticket.scope.sso
Client-Local	bondy.issue	bondy.ticket.scope.client_local
Client-SSO	bondy.issue	bondy.ticket.scope.client_sso

Procedures

bondy.ticket.issue(;expiry_time_secs=,...) -> [map()]

Issues a ticket for the calling session's own identity, in the session's realm. The call takes no positional arguments.

Call

Positional Args

None.

Keyword Args

expiry_time_secsinteger

Default: The value of Bondy configuration parameter 'security.ticket.expiry_time'. Bondy caps the value at 'security.ticket.max_expiry_time'.

allow_ssoboolean

Default: true

client_ticketstring

client_idstring

device_idstring

authrolesarray[undefined]

A role RESTRICTION for the delegation use case: a non-empty subset of the issuing session's own roles (groups). A session authenticated with the resulting ticket gets exactly these roles, non-negotiably — the bearer may request fewer at establishment but can never widen past them, and a request entirely outside them is refused. Requesting a role the issuing session does not hold refuses the issue. Absent means unrestricted, which is also how every ticket issued before this option existed behaves.

Result

Positional Args

The call result is a single positional argument: a map holding the encoded and signed ticket and its claims.

0mapREQUIRED

The ticket and its claims.

Keyword Args

None.

bondy.ticket.revoke(realm_uri, ticket) -> []

Revokes a ticket. The caller does not need to be the ticket's owner. Any caller that holds the ticket can already use it, so the router also lets that caller revoke it.

Revocation applies to the ticket's scope. The router replaces the claims stored under that scope with a revocation marker. The call therefore also revokes any other ticket issued to the same user in the same scope. The marker replicates to the other nodes of the cluster and stays until the ticket expires. A node that has received the marker rejects the ticket, whatever the value of security.ticket.allow_not_found.

Revocation needs persistence

A node checks for the marker only when persistence is on for the ticket's scope type, which is the default. See security.ticket.scope.*.persistence in the Security Configuration Reference. When persistence is off for a scope type, a revoked ticket of that type stays valid until it expires.

The router verifies the ticket before it revokes it. When the ticket fails verification, for example because it has expired or was already revoked, the router does not revoke it and the call returns an error.

Call

Positional Args

0string

The URI of the calling session's realm. When you omit it, the router uses the session's realm. A session attached to a realm other than the Master Realm cannot name a different realm.

1stringREQUIRED

The encoded ticket to revoke.

Keyword Args

None.

Result

Positional Args

None.

Keyword Args

None.

bondy.ticket.revoke_all(realm_uri, authid) -> []

Revokes every ticket issued to the user authid in the realm, including the tickets that grant access to other realms through Single Sign-on. Like bondy.ticket.revoke, it writes revocation markers that replicate to the other nodes of the cluster.

Call

Positional Args

0string

The URI of the realm to revoke the tickets in. When you omit it, the router uses the session's realm. A session attached to a realm other than the Master Realm cannot name a different realm.

1stringREQUIRED

The authid of the user associated with the tickets we want to revoke.

Keyword Args

None.

Result

Positional Args

None.

Keyword Args

None.