CreateAccessProvider

Not available in this language yet.
Not available in this language yet.
Not available in this language yet.
CreateAccessProvider( param_object )
Not available in this language yet.
Not available in this language yet.

Description

CreateAccessProvider creates a new AccessProvider document, based on the settings in param_object, which can be used to control access to the current database via a third-party identity provider (IdP) , such as Auth0.

Once an AccessProvider has been created and your IdP has been configured properly, users can authenticate via the authentication service and then access Fauna. This avoid having to handle authentication yourself, via Login or by managing Keys.

Parameters

Argument Type Definition and Requirements

param_object

Object

The param_object fields are described below.

param_object

Field Name Field Type Definition and Requirements

name

String

A unique name for the AccessProvider. You can use this name to retrieve the AccessProvider later.

issuer

String

An HTTPS URI for the IdP that you are using to grant access to Fauna. This is typically an account-/app-specific URI that your IdP provides.

jwks_uri

String

A valid HTTPS URI, which should serve the JSON Web Key that signs the JWT tokens from your IdP.

roles

Array of Role References or Role-predicate objects.

Optional - Defines the roles that should be evaluated to determine access for a provided JWT token.

When roles is not specified, no privileges are defined — queries with JWT tokens from the specified issuer cannot be processed.

The usual use of roles is to specify a list of one or more Role references:

roles: [ Role('developers'), Role('managers') ]

Per overlapping roles, any role that grants access means that the query involving a JWT token is processed, even if another Role might deny access.

A Role-predicate object specifies a Role to potentially evaluate, whose evaluation is determined by the specified predicate function:

{
  role: Role('executives'),
  predicate: Query(Lambda("accessToken", ... )),
}

The predicate function is passed an object representing the payload field from the JWT token. The payload field contains claims, which are statements about the user represented by the JWT token. How these claims are specified/interpreted can vary depending on the IdP. See https://jwt.io/introduction/ for background information, and your IdP’s documentation, for more details.

The predicate function must return a boolean value, and if the result is true, the specified Role is evaluated to determine whether the access required to execute the query (in the request accompanying the JWT token) has been granted.

data

Object

Optional - Contains user-defined metadata for the AccessProvider. It is provided for the developer to store AccessProvider-relevant information.

Returns

An object containing the metadata about the results of CreateAccessProvider operations.

Field Name Field Type Definition and Requirements

ref

Reference

The reference is an automatically-generated, unique identifier within the database to the AccessProvider that was created.

ts

Integer

The timestamp, with microsecond resolution, associated with the creation of the AccessProvider.

name

String

The name for this AccessProvider.

issuer

String

The issuer value that was provided when creating the AccessProvider.

jwks_uri

String

The jwks_uri value that was provided when creating the AccessProvider.

audience

String

A database-specific HTTP URI. Queries that should be authenticated using a JWT token should use this URI, instead of the default https://db.fauna.com/ successful login.

Every AccessProvider for the current database shares the same audience URI.

Examples

Not available in this language yet.
Not available in this language yet.
Not available in this language yet.
client.query(
  q.CreateAccessProvider({
    name: 'Auth0-myapp',
    issuer: 'https://myapp.auth0.com/',
    jwks_uri: 'https://myapp.auth0.com/.well-known/jwks.json',
  })
)
.then((ret) => console.log(ret))
.catch((err) => console.error('Error: %s', err))
{
  ref: AccessProvider("Auth0-myapp"),
  ts: 1604524688650000,
  name: 'Auth0-myapp',
  issuer: 'https://myapp.auth0.com/',
  jwks_uri: 'https://myapp.auth0.com/.well-known/jwks.json',
  audience: 'https://db.fauna.com/db/yxuihtdghybyy'
}
Not available in this language yet.
Not available in this language yet.

Was this article helpful?

We're sorry to hear that.
Tell us how we can improve!
 Visit Fauna's Discourse forums or email docs@fauna.com

Thank you for your feedback!