Registries Webapp and API

Registries Web Application and API Overview

This page presents an overview of the Registries web application and backend API features and functionality. It is intended to document how features are implemented to assist contributors with development and maintenance.

API

Authentication

Authentication uses JSON Web Tokens (JWT) provided and signed by our OpenID Connect (OIDC) provider. JWTs are sent in request headers as follows:

Authorization: JWT xxxxxxxxxxxx

The Registries API backend uses the django-restframework-jwt package to decode JWT tokens and verify their signature. Once we have verified that the JWT was signed by the GWELLS OIDC provider, the auth backend class in gwells/authentication.py retrieves the user profile that matches the Keycloak GUID in the 'sub' claim of the token. If the user doesn't exist yet, a profile is automatically created.

When a profile is retrieved, the Django User object is attached to request.user and is available to the view classes in views.py. Each user object has a user.profile that stores data such as preferred name and GWELLS admin status.