I am going to be making several websites for a clients.

I look for components that I can use to cut down on the development time and deliver higher quality. As part of that I am looking for a preferably language agnostic cloud service that can handle at a high level:

  • Authentication,
  • Authorization and
  • Accounting

Google, Facebook, Persona can handle Identity (Authentication), but not the rest.

Basically an API conceptually something like this:

  • SomeService.LogIn()
  • SomeService.LogOut()
  • SomeService.Lock()
  • SomeService.Cancel()
  • SomeService.HasPermission()
  • SomeService.GivePermission()
  • SomeService.RevokePermission()
  • SomeService.IsMemberOf()
  • SomeService.AddAsMembmerOf()
  • SomeService.RemoveAsMemberOf()

The service would also handle the storing of user accounts, handle password, password resets, securing the login process.

In addition to having a cloud based API that I use inside my website for AAA.

  • 1
    We will need much more information to give good recommendations here. Please take a look at What is required for a question to contain "enough information"? Then please edit your question and see if you can incorporate some of these improvements.
    – danijelc
    Feb 24 '14 at 17:13
  • 2
    Does it really have to be a cloud service? That sounds more like something I'd want as a library — externalizing authentication is one thing, but I wouldn't want to externalize my user database. Feb 24 '14 at 17:54
  • I would want it as a service, so I can externalize this part of the websites. Feb 24 '14 at 20:01
  • 1
    It sounds like you need OAuth in combination with software to manage accounting. I would consider keeping authentication separate than accounting as it will aid security (authentication is then kept within its own self contained, external service). Feb 25 '14 at 9:26

I agree that OAuth 2.0 is a good choice for Authentication and Authorization. If the different clients need a different access to your API, then you can use scopes in OAuth 2.0 specification. You can take a look at http://apifest.com - ApiFest is an open-source Java project you can check on github. It contains an OAuth 2.0 implementation(ApiFest OAuth 2.0 Server) and API management server - ApiFest Mapping Server. Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.