Authentication flow

Workflow for setting up the Deployment Agent (client) on a device and registering it to Deployment Manager (server) for the first time.

The device and server talk over two protocols: ZeroMQ and HTTP. ZeroMQ is for pub/sub communication (sending software updates, getting back status and logs) and HTTP is for management tasks over a RESTful API. The Deployment GUI makes extensive use of the RESTful API.

The sequence is illustrated below:

1. The Deployment Manager generates a persistent CurveZMQ key pair (M_keypair).
2. A user authenticates¹ and asks for a token² from server over the RESTful API (TLS/CA-signed certificate).
3. The user manually copies the token to device.
4. The user installs the Deployment Agent on device, which starts a background service.
5. The Deployment Agent generates a persistent CurveZMQ key pair (A_keypair).
6. The Deployment Agent submits the token, its CurveZMQ public key (A_pub), and metadata for device registration to server's RESTful API.
7. The Deployment Manager verifies the token and registration document, if valid:
   1. Invalidates the token and registers the device
   2. Responds with its CurveZMQ public key (M_pub).
8. The Deployment Agent contacts the server over ZeroMQ. They establish a secure channel using CurveZMQ³.

¹ OpenID Connect authentication.
² Token is an ephemeral key, valid for a short time and single usage.
³ We use the Ironhouse pattern.