Standard -server to server- and -browser to server- authentication method

Question

I have server with some resources; until now all these resources were requested through a browser by a human user, and the authentication was made with an username/password method, that generates a cookie with a token (to have the session open for some time).

Right now the system requires that other servers make GET requests to this resource server but they have to authenticate to get them. We have been using a list of authorized IPs but having two authentication methods makes the code more complex.

My questions are:

• Is there any standard method or pattern to authenticate human users and servers using the same code?

• If there is not, are the methods I'm using now the right ones or is there a better / more standard way to accomplish what I need?

Thanks in advance for any suggestion.

Answer 1

Like @Ryanthal have pointed out, impersonate the server (I'll call it consumer-server) is a good shot. For me the method your are using is common, and I'm going to use a very similar one.

A little flow you can use to impersonate your server is:

1. The consumer-server post to the login page, the user and password (an account specifically created for that server)
2. The credentials are validated, and it replies with the authentication cookie (you already do that,for the browsers)
3. The consumer-server inspect the response and sto re the authentication cookie, in it's session/memory
4. Consumer-server pass the cookie in the following GETs

For a way of reading/setting the cookie in the consumer-servers take a look here, the cookie is simply a argument passed in the response/request.

Pros:

• Unified authentication for both users (browsers) and machines (consumer-servers)
• If the server changes it's IP, you don't have to wory about
• Easier to constraint the consumer-server permissions, relying on authorization mechanisms

Cons:

• You may have to touch the consumer-servers, it may be off hand if you do not control it

Answer 2

Make your servers impersonate users, your authentication system doesn't need to know they are servers or other users, you just need to ensure that authentication never fails for the users that are actually servers.