2

I have configured composer-rest-server. I had also provided fabric username/password while configuring composer-rest-server (WebAppAdmin or admin). Now, I can able to access REST API without providing any credentials (through postman or loopback).

I would like to understand how we can secure composer-rest-server. Though, I have understood that we can add participant and issue identity, but not able to connect logical dots in context of how everything will work.

  • How to secure composer-rest-server while accessing REST API?
  • When and How we are going to use "username/secret" registered against any participant?
  • When to authenticate composer-rest-server API and When to use participant identity to access business network?
deepak parmar
  • 691
  • 1
  • 6
  • 20

1 Answers1

2

Please see the documentation on this subject: https://hyperledger.github.io/composer/integrating/enabling-rest-authentication.html

Simon Stone
  • 495
  • 2
  • 4
  • 1
    Thank You Simon. I saw this document, but what i am bit confused about the part that how composer-rest-server is going to manage identity, private key , certificates and wallet. I have clarity about we can use passport strategy of our choice to secure composer-rest-server, but then how rest-server later is going to manage wallet? I've following queries - Who and How to administrate composer-rest-server? Will have to write separate application to administrate composer-rest-server? - How can we configure composer-rest-server to store different identity and wallet at different location? – deepak parmar Jun 14 '17 at 05:28
  • It would be great if you can share some diagram if you have. – deepak parmar Jun 14 '17 at 05:28
  • 1
    Comment from Deepak, which points to my Stack Overflow post that explains the whole authentication flow: https://stackoverflow.com/questions/43655553/how-to-authenticate-to-rest-api-and-map-to-fabric-credentials – Simon Stone Jun 20 '17 at 03:40