mirror of
https://github.com/sonr-io/sonr.git
synced 2026-08-02 09:21:39 +00:00
> Ran tool: github_create_or_update_file
> > *Failed*: > ``` > failed to create/update file: PUT https://api.github.com/repos/sonr-io/sonr-io.github.io/contents/docs/guides/decentralized-authentication.mdx: 401 Bad credentials [] > ``` > Ran tool: `github_create_or_update_file` > > *Failed*: > ``` > failed to create/update file: PUT https://api.github.com/repos/sonr-io/sonr-io.github.io/contents/docs/guides/decentralized-authentication.mdx: 401 Bad credentials [] > ``` docs: Remove decentralized authentication guide
This commit is contained in:
Prad Nukala
@@ -1,191 +0,0 @@
|
|||||||
---
|
|
||||||
title: "Migrating from Centralized to Decentralized Authentication"
|
|
||||||
description: "A comprehensive guide to migrating from centralized 8787 endpoints to decentralized OIDC authentication with WebAuthn"
|
|
||||||
sidebarTitle: "Decentralized Authentication"
|
|
||||||
icon: "key"
|
|
||||||
---
|
|
||||||
|
|
||||||
# Migrating from Centralized to Decentralized Authentication
|
|
||||||
|
|
||||||
## Overview
|
|
||||||
|
|
||||||
Sonr is transitioning from a centralized authentication model using 8787 endpoints to a fully decentralized, privacy-preserving authentication system leveraging OpenID Connect (OIDC), Self-Issued OpenID Provider (SIOP), and WebAuthn technologies.
|
|
||||||
|
|
||||||
### Key Improvements
|
|
||||||
|
|
||||||
- **Decentralization**: Move from centralized identity management to self-sovereign identity
|
|
||||||
- **WebAuthn Integration**: Hardware-backed, phishing-resistance authentication
|
|
||||||
- **Gasless Onboarding**: Zero-cost user registration and transactions
|
|
||||||
- **Automatic Vault Creation**: Seamless user experience with instant identity setup
|
|
||||||
- **Enhanced Privacy**: DID-based authentication with verifiable presentations
|
|
||||||
|
|
||||||
## Architecture Comparison
|
|
||||||
|
|
||||||
### Old Architecture: Centralized 8787 Endpoints
|
|
||||||
|
|
||||||
- Centralized authentication server
|
|
||||||
- Fixed credential storage
|
|
||||||
- Limited authentication methods
|
|
||||||
- Higher security risks
|
|
||||||
|
|
||||||
### New Architecture: Decentralized OIDC Provider
|
|
||||||
|
|
||||||
```mermaid
|
|
||||||
graph TD
|
|
||||||
A[User Device] --> B{WebAuthn Registration}
|
|
||||||
B --> |Credential Generation| C[Blockchain Bridge]
|
|
||||||
C --> |Broadcast Credential| D[Sonr Blockchain]
|
|
||||||
D --> |Create DID| E[User's Decentralized Identity]
|
|
||||||
E --> |SIOP Flow| F[OIDC Provider]
|
|
||||||
F --> |Verifiable Presentation| G[Service Provider]
|
|
||||||
```
|
|
||||||
|
|
||||||
## Migration Steps
|
|
||||||
|
|
||||||
### 1. Prerequisites
|
|
||||||
|
|
||||||
- Go 1.24.1+
|
|
||||||
- Cosmos SDK v0.50.14
|
|
||||||
- WebAuthn-compatible browser/device
|
|
||||||
- Updated Sonr SDK
|
|
||||||
|
|
||||||
### 2. Configuration Changes
|
|
||||||
|
|
||||||
#### Environment Variables
|
|
||||||
|
|
||||||
<CodeGroup>
|
|
||||||
```bash title="Old Configuration"
|
|
||||||
# Centralized auth endpoints
|
|
||||||
AUTH_ENDPOINT=https://8787.sonr.io/auth
|
|
||||||
AUTH_CLIENT_ID=legacy-client-id
|
|
||||||
```
|
|
||||||
|
|
||||||
```bash title="New Configuration"
|
|
||||||
# Decentralized OIDC configuration
|
|
||||||
OIDC_PROVIDER_URL=https://oidc.sonr.network
|
|
||||||
WEBAUTHN_ORIGIN=https://your-app.com
|
|
||||||
DID_RESOLVER_URL=https://did.sonr.network
|
|
||||||
```
|
|
||||||
|
|
||||||
</CodeGroup>
|
|
||||||
|
|
||||||
### 3. Endpoint Migration
|
|
||||||
|
|
||||||
| Old Endpoint | New Endpoint | Changes |
|
|
||||||
| ---------------- | -------------------- | ----------------------- |
|
|
||||||
| `/auth/login` | `/oidc/authorize` | OIDC authorization flow |
|
|
||||||
| `/auth/register` | `/webauthn/register` | WebAuthn registration |
|
|
||||||
| `/auth/token` | `/oidc/token` | Token issuance via SIOP |
|
|
||||||
|
|
||||||
### 4. API Changes
|
|
||||||
|
|
||||||
#### Request Format
|
|
||||||
|
|
||||||
<CodeGroup>
|
|
||||||
```json title="Legacy Request"
|
|
||||||
{
|
|
||||||
"username": "user@example.com",
|
|
||||||
"password": "legacy-password"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
```json title="New WebAuthn Request"
|
|
||||||
{
|
|
||||||
"challenge": "base64-encoded-challenge",
|
|
||||||
"attestation": {
|
|
||||||
"type": "public-key",
|
|
||||||
"id": "credential-id",
|
|
||||||
"rawId": "base64-encoded-raw-credential",
|
|
||||||
"response": {
|
|
||||||
"clientDataJSON": "...",
|
|
||||||
"attestationObject": "..."
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
</CodeGroup>
|
|
||||||
|
|
||||||
### 5. WebAuthn Integration
|
|
||||||
|
|
||||||
#### Registration Flow
|
|
||||||
|
|
||||||
1. Generate registration challenge
|
|
||||||
2. Create WebAuthn credential
|
|
||||||
3. Broadcast credential to blockchain
|
|
||||||
4. Automatically create user vault
|
|
||||||
5. Issue decentralized identifier (DID)
|
|
||||||
|
|
||||||
#### Code Example
|
|
||||||
|
|
||||||
```go title="WebAuthn Registration Handler"
|
|
||||||
func (s *Server) HandleWebAuthnRegistration(w http.ResponseWriter, r *http.Request) {
|
|
||||||
// 1. Validate WebAuthn attestation
|
|
||||||
credential, err := s.webAuthnService.VerifyRegistration(attestationData)
|
|
||||||
|
|
||||||
// 2. Broadcast to blockchain
|
|
||||||
didDoc, err := s.blockchainBridge.CreateDID(credential)
|
|
||||||
|
|
||||||
// 3. Create user vault
|
|
||||||
vault, err := s.vaultService.CreateVault(didDoc)
|
|
||||||
|
|
||||||
// 4. Issue OIDC token
|
|
||||||
token := s.oidcService.IssueToken(didDoc)
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### 6. SIOP (Self-Issued OpenID Provider)
|
|
||||||
|
|
||||||
#### Key Concepts
|
|
||||||
|
|
||||||
- Verifiable Presentations
|
|
||||||
- Decentralized Identifiers (DIDs)
|
|
||||||
- User-controlled authentication
|
|
||||||
|
|
||||||
### 7. Error Handling
|
|
||||||
|
|
||||||
#### Migration Errors
|
|
||||||
|
|
||||||
| Error Code | Description | Mitigation |
|
|
||||||
| ------------------------ | ---------------------- | -------------------- |
|
|
||||||
| `AUTH_LEGACY_DEPRECATED` | Legacy auth method | Upgrade client |
|
|
||||||
| `WEBAUTHN_UNSUPPORTED` | Device incompatibility | Use alternative auth |
|
|
||||||
| `DID_RESOLUTION_FAILED` | Identity verification | Retry registration |
|
|
||||||
|
|
||||||
### 8. Testing Migration
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Validate WebAuthn registration
|
|
||||||
sonr webauthn test-registration
|
|
||||||
|
|
||||||
# Verify OIDC provider
|
|
||||||
sonr oidc validate-provider
|
|
||||||
|
|
||||||
# Check DID resolution
|
|
||||||
sonr did resolve did:sonr:example
|
|
||||||
```
|
|
||||||
|
|
||||||
### 9. Breaking Changes
|
|
||||||
|
|
||||||
- Legacy password authentication removed
|
|
||||||
- Token format changed to JWT with DID claims
|
|
||||||
- New client libraries required
|
|
||||||
- WebAuthn mandatory for registration
|
|
||||||
|
|
||||||
## Rollback Procedure
|
|
||||||
|
|
||||||
If issues arise:
|
|
||||||
|
|
||||||
1. Maintain legacy user mappings
|
|
||||||
2. Provide fallback authentication
|
|
||||||
3. Gradual, opt-in migration
|
|
||||||
|
|
||||||
## Conclusion
|
|
||||||
|
|
||||||
This migration represents a significant leap in authentication security and user privacy. By adopting WebAuthn, SIOP, and blockchain-backed identities, we're creating a more robust, user-controlled authentication ecosystem.
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- [Sonr Developer Docs](/docs)
|
|
||||||
- [WebAuthn Specification](https://www.w3.org/TR/webauthn-2/)
|
|
||||||
- [OIDC Community](https://openid.net/developers/specs/)
|
|
||||||
@@ -1,129 +0,0 @@
|
|||||||
---
|
|
||||||
title: "DID Generation and Management"
|
|
||||||
description: "Learn how to generate and manage Decentralized Identifiers (DIDs) using advanced crypto interfaces"
|
|
||||||
sidebarTitle: "Identity Generation"
|
|
||||||
icon: "signature"
|
|
||||||
---
|
|
||||||
|
|
||||||
# DID Generation Patterns
|
|
||||||
|
|
||||||
The Sonr project provides a robust and flexible DID (Decentralized Identifier) generation system supporting multiple key types and cryptographic methods.
|
|
||||||
|
|
||||||
## Supported Key Types
|
|
||||||
|
|
||||||
The `didkey.go` interface supports the following key types:
|
|
||||||
|
|
||||||
- RSA Public Keys
|
|
||||||
- Ed25519 Public Keys
|
|
||||||
- Secp256k1 Public Keys
|
|
||||||
|
|
||||||
## Basic DID Generation
|
|
||||||
|
|
||||||
### Creating a DID from a Public Key
|
|
||||||
|
|
||||||
```go
|
|
||||||
import (
|
|
||||||
"github.com/libp2p/go-libp2p/core/crypto"
|
|
||||||
"github.com/sonr-io/crypto/keys"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Generate a new key pair
|
|
||||||
privateKey, publicKey, err := crypto.GenerateKeyPair(crypto.Ed25519, -1)
|
|
||||||
|
|
||||||
// Create a DID
|
|
||||||
did, err := keys.NewDID(publicKey)
|
|
||||||
```
|
|
||||||
|
|
||||||
### Parsing an Existing DID
|
|
||||||
|
|
||||||
```go
|
|
||||||
// Parse a DID string
|
|
||||||
did, err := keys.Parse("did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGTsyDFWYviJr4")
|
|
||||||
```
|
|
||||||
|
|
||||||
## Advanced DID Operations
|
|
||||||
|
|
||||||
### Address Derivation
|
|
||||||
|
|
||||||
```go
|
|
||||||
// Get a blockchain-compatible address from a DID
|
|
||||||
address, err := did.Address()
|
|
||||||
```
|
|
||||||
|
|
||||||
### Compressed Public Key Retrieval
|
|
||||||
|
|
||||||
```go
|
|
||||||
// Get a compressed public key (for Secp256k1)
|
|
||||||
compressedPubKey, err := did.CompressedPubKey()
|
|
||||||
```
|
|
||||||
|
|
||||||
## MPC Enclave DID Generation
|
|
||||||
|
|
||||||
For MPC (Multi-Party Computation) enclaves, use a specialized method:
|
|
||||||
|
|
||||||
```go
|
|
||||||
// Create a DID from MPC enclave public key bytes
|
|
||||||
did, err := keys.NewFromMPCPubKey(enclavePublicKeyBytes)
|
|
||||||
```
|
|
||||||
|
|
||||||
## DID Validation
|
|
||||||
|
|
||||||
```go
|
|
||||||
// Validate a DID format
|
|
||||||
err := keys.ValidateFormat("did:key:example123")
|
|
||||||
```
|
|
||||||
|
|
||||||
## Multicodec Support
|
|
||||||
|
|
||||||
The library supports various multicodec prefixes for different key types:
|
|
||||||
|
|
||||||
- RSA: `0x1205`
|
|
||||||
- Ed25519: `0xed`
|
|
||||||
- Secp256k1: `0xe7`
|
|
||||||
|
|
||||||
## Security Considerations
|
|
||||||
|
|
||||||
- Always generate keys using cryptographically secure methods
|
|
||||||
- Validate DIDs before using them in critical operations
|
|
||||||
- Use the appropriate key type for your security requirements
|
|
||||||
|
|
||||||
## Example: Complete DID Workflow
|
|
||||||
|
|
||||||
```go
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"github.com/libp2p/go-libp2p/core/crypto"
|
|
||||||
"github.com/sonr-io/crypto/keys"
|
|
||||||
)
|
|
||||||
|
|
||||||
func main() {
|
|
||||||
// Generate a new key pair
|
|
||||||
privateKey, publicKey, err := crypto.GenerateKeyPair(crypto.Ed25519, -1)
|
|
||||||
if err != nil {
|
|
||||||
panic(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Create a DID
|
|
||||||
did, err := keys.NewDID(publicKey)
|
|
||||||
if err != nil {
|
|
||||||
panic(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get the DID string
|
|
||||||
didString := did.String()
|
|
||||||
fmt.Println("Generated DID:", didString)
|
|
||||||
|
|
||||||
// Derive blockchain address
|
|
||||||
address, err := did.Address()
|
|
||||||
if err != nil {
|
|
||||||
panic(err)
|
|
||||||
}
|
|
||||||
fmt.Println("Blockchain Address:", address)
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
## Compatibility and Interoperability
|
|
||||||
|
|
||||||
The Sonr DID implementation follows the W3C DID specification, ensuring broad compatibility with other decentralized identity systems.
|
|
||||||
@@ -1,191 +0,0 @@
|
|||||||
---
|
|
||||||
title: "Migrating from Centralized to Decentralized Authentication"
|
|
||||||
description: "A comprehensive guide to migrating from centralized 8787 endpoints to decentralized OIDC authentication with WebAuthn"
|
|
||||||
sidebarTitle: "Decentralized Authentication"
|
|
||||||
icon: "key"
|
|
||||||
---
|
|
||||||
|
|
||||||
# Migrating from Centralized to Decentralized Authentication
|
|
||||||
|
|
||||||
## Overview
|
|
||||||
|
|
||||||
Sonr is transitioning from a centralized authentication model using 8787 endpoints to a fully decentralized, privacy-preserving authentication system leveraging OpenID Connect (OIDC), Self-Issued OpenID Provider (SIOP), and WebAuthn technologies.
|
|
||||||
|
|
||||||
### Key Improvements
|
|
||||||
|
|
||||||
- **Decentralization**: Move from centralized identity management to self-sovereign identity
|
|
||||||
- **WebAuthn Integration**: Hardware-backed, phishing-resistance authentication
|
|
||||||
- **Gasless Onboarding**: Zero-cost user registration and transactions
|
|
||||||
- **Automatic Vault Creation**: Seamless user experience with instant identity setup
|
|
||||||
- **Enhanced Privacy**: DID-based authentication with verifiable presentations
|
|
||||||
|
|
||||||
## Architecture Comparison
|
|
||||||
|
|
||||||
### Old Architecture: Centralized 8787 Endpoints
|
|
||||||
|
|
||||||
- Centralized authentication server
|
|
||||||
- Fixed credential storage
|
|
||||||
- Limited authentication methods
|
|
||||||
- Higher security risks
|
|
||||||
|
|
||||||
### New Architecture: Decentralized OIDC Provider
|
|
||||||
|
|
||||||
```mermaid
|
|
||||||
graph TD
|
|
||||||
A[User Device] --> B{WebAuthn Registration}
|
|
||||||
B --> |Credential Generation| C[Blockchain Bridge]
|
|
||||||
C --> |Broadcast Credential| D[Sonr Blockchain]
|
|
||||||
D --> |Create DID| E[User's Decentralized Identity]
|
|
||||||
E --> |SIOP Flow| F[OIDC Provider]
|
|
||||||
F --> |Verifiable Presentation| G[Service Provider]
|
|
||||||
```
|
|
||||||
|
|
||||||
## Migration Steps
|
|
||||||
|
|
||||||
### 1. Prerequisites
|
|
||||||
|
|
||||||
- Go 1.24.1+
|
|
||||||
- Cosmos SDK v0.50.14
|
|
||||||
- WebAuthn-compatible browser/device
|
|
||||||
- Updated Sonr SDK
|
|
||||||
|
|
||||||
### 2. Configuration Changes
|
|
||||||
|
|
||||||
#### Environment Variables
|
|
||||||
|
|
||||||
<CodeGroup>
|
|
||||||
```bash title="Old Configuration"
|
|
||||||
# Centralized auth endpoints
|
|
||||||
AUTH_ENDPOINT=https://8787.sonr.io/auth
|
|
||||||
AUTH_CLIENT_ID=legacy-client-id
|
|
||||||
```
|
|
||||||
|
|
||||||
```bash title="New Configuration"
|
|
||||||
# Decentralized OIDC configuration
|
|
||||||
OIDC_PROVIDER_URL=https://oidc.sonr.network
|
|
||||||
WEBAUTHN_ORIGIN=https://your-app.com
|
|
||||||
DID_RESOLVER_URL=https://did.sonr.network
|
|
||||||
```
|
|
||||||
|
|
||||||
</CodeGroup>
|
|
||||||
|
|
||||||
### 3. Endpoint Migration
|
|
||||||
|
|
||||||
| Old Endpoint | New Endpoint | Changes |
|
|
||||||
| ---------------- | -------------------- | ----------------------- |
|
|
||||||
| `/auth/login` | `/oidc/authorize` | OIDC authorization flow |
|
|
||||||
| `/auth/register` | `/webauthn/register` | WebAuthn registration |
|
|
||||||
| `/auth/token` | `/oidc/token` | Token issuance via SIOP |
|
|
||||||
|
|
||||||
### 4. API Changes
|
|
||||||
|
|
||||||
#### Request Format
|
|
||||||
|
|
||||||
<CodeGroup>
|
|
||||||
```json title="Legacy Request"
|
|
||||||
{
|
|
||||||
"username": "user@example.com",
|
|
||||||
"password": "legacy-password"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
```json title="New WebAuthn Request"
|
|
||||||
{
|
|
||||||
"challenge": "base64-encoded-challenge",
|
|
||||||
"attestation": {
|
|
||||||
"type": "public-key",
|
|
||||||
"id": "credential-id",
|
|
||||||
"rawId": "base64-encoded-raw-credential",
|
|
||||||
"response": {
|
|
||||||
"clientDataJSON": "...",
|
|
||||||
"attestationObject": "..."
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
</CodeGroup>
|
|
||||||
|
|
||||||
### 5. WebAuthn Integration
|
|
||||||
|
|
||||||
#### Registration Flow
|
|
||||||
|
|
||||||
1. Generate registration challenge
|
|
||||||
2. Create WebAuthn credential
|
|
||||||
3. Broadcast credential to blockchain
|
|
||||||
4. Automatically create user vault
|
|
||||||
5. Issue decentralized identifier (DID)
|
|
||||||
|
|
||||||
#### Code Example
|
|
||||||
|
|
||||||
```go title="WebAuthn Registration Handler"
|
|
||||||
func (s *Server) HandleWebAuthnRegistration(w http.ResponseWriter, r *http.Request) {
|
|
||||||
// 1. Validate WebAuthn attestation
|
|
||||||
credential, err := s.webAuthnService.VerifyRegistration(attestationData)
|
|
||||||
|
|
||||||
// 2. Broadcast to blockchain
|
|
||||||
didDoc, err := s.blockchainBridge.CreateDID(credential)
|
|
||||||
|
|
||||||
// 3. Create user vault
|
|
||||||
vault, err := s.vaultService.CreateVault(didDoc)
|
|
||||||
|
|
||||||
// 4. Issue OIDC token
|
|
||||||
token := s.oidcService.IssueToken(didDoc)
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### 6. SIOP (Self-Issued OpenID Provider)
|
|
||||||
|
|
||||||
#### Key Concepts
|
|
||||||
|
|
||||||
- Verifiable Presentations
|
|
||||||
- Decentralized Identifiers (DIDs)
|
|
||||||
- User-controlled authentication
|
|
||||||
|
|
||||||
### 7. Error Handling
|
|
||||||
|
|
||||||
#### Migration Errors
|
|
||||||
|
|
||||||
| Error Code | Description | Mitigation |
|
|
||||||
| ------------------------ | ---------------------- | -------------------- |
|
|
||||||
| `AUTH_LEGACY_DEPRECATED` | Legacy auth method | Upgrade client |
|
|
||||||
| `WEBAUTHN_UNSUPPORTED` | Device incompatibility | Use alternative auth |
|
|
||||||
| `DID_RESOLUTION_FAILED` | Identity verification | Retry registration |
|
|
||||||
|
|
||||||
### 8. Testing Migration
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Validate WebAuthn registration
|
|
||||||
sonr webauthn test-registration
|
|
||||||
|
|
||||||
# Verify OIDC provider
|
|
||||||
sonr oidc validate-provider
|
|
||||||
|
|
||||||
# Check DID resolution
|
|
||||||
sonr did resolve did:sonr:example
|
|
||||||
```
|
|
||||||
|
|
||||||
### 9. Breaking Changes
|
|
||||||
|
|
||||||
- Legacy password authentication removed
|
|
||||||
- Token format changed to JWT with DID claims
|
|
||||||
- New client libraries required
|
|
||||||
- WebAuthn mandatory for registration
|
|
||||||
|
|
||||||
## Rollback Procedure
|
|
||||||
|
|
||||||
If issues arise:
|
|
||||||
|
|
||||||
1. Maintain legacy user mappings
|
|
||||||
2. Provide fallback authentication
|
|
||||||
3. Gradual, opt-in migration
|
|
||||||
|
|
||||||
## Conclusion
|
|
||||||
|
|
||||||
This migration represents a significant leap in authentication security and user privacy. By adopting WebAuthn, SIOP, and blockchain-backed identities, we're creating a more robust, user-controlled authentication ecosystem.
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- [Sonr Developer Docs](/docs)
|
|
||||||
- [WebAuthn Specification](https://www.w3.org/TR/webauthn-2/)
|
|
||||||
- [OIDC Community](https://openid.net/developers/specs/)
|
|
||||||
Reference in New Issue
Block a user