Definitions

An application is deployed to a network if the callback URL registered on that network points directly to the application

An application is registered to a network if the callback URL provides access to the application, not necessarily directly to the application's URL endpoint.

A Deployed Network is a network where an application is deployed. "Deployed" means that the application registration on the network points directly to the application's URL.

A Host Network is a network where an application is registered to point to a proxy URL on the Deployed Network. They "host" the application for their users. 

Overview

Many networks may access a deployed application. This access must be able to be authenticated and (eventually) authorized.

Design

The Social Container contains all application registrations on a Ringside network. These registrations can be a combination of deployments and access to remote-hosted applications. When calling a remote application (hosted by another Social Container), the request will use a Network Key and Network Secret to authenticate the requests. 

Trust authorities need to be registered on the Provider Network. Each network has its own registration for an application with a separate API key and secret. Social needs to authenticate the incoming signature against the specifically-registered API key and secret. This API key and secret will provide access for that application only to the Host Network.

Sessions are scoped to Network ID and User ID (NID, UID). There could be additional attributes for social sessions access from different networks. This feature will enable skinning, custom presentations, alternative configuration, etc. based on the Host Network invoking the application on behalf of one of its users.

Diagram: Application Provisioning Across Networks

Tasks

Include network ID in API implementation context

Update existing APIs/applications to support NID, PID, UID

Limited sessions for widgets (restrict to logged-in user for all UID parameters) 

Show session initiation for an application being accessed by an outside network 

Depends on

Session (Social), DB/DAO, Key Management (via control panel?) 

Others depend on

Multi-tenancy, Applications