Overview

Libra is an authentication and authorization proxy in front of an NGSI-LD context broker. It authenticates the caller, decides against a policy set, narrows the request to what the policy allows, forwards it to the broker, and filters the response on its way back. Libra stores no context data.

Open beta

Libra is an open beta and under active development. It has not been independently audited, so do not put it in front of production data yet. Known limitations lists what this release does not defend.

How a request goes through

Every request passes through the same five stages.

1. Caller

   A client of the context data: a service, a script, a dashboard.
2. AuthenticateLibra

   API key Libra issued, or a JWT from your identity provider. The credential stops here.401 with no usable credential
3. DecideLibra

   The request is matched against the TOML policy set.403 when no policy allows it
4. NarrowLibra

   The request is rewritten to the entity types, attributes, scopes and time window the policy allows.
5. Context broker

   Plain NGSI-LD, unchanged. Told who asked through X-Auth-* headers; it never sees the credential.
6. FilterLibra

   The response is filtered on the way back, whether or not the broker honoured the narrowing.
7. Caller

   Sees only what the policy allows.

Libra fails closed, so when it cannot decide, it refuses. Startup either succeeds completely or stops, and an unknown configuration key or policy key is a startup error rather than a silently ignored rule.