Authentication and capabilities
SIWS sessions, scoped authority, and operator trust.
Session model
The always-compiled auth domain uses MARS principals, capability sets, challenge/session stores, and registered adapters. SIWS is the concrete credential adapter in this release. OpenAgent and Arsenal names are reserved extension identifiers, not working login providers.
A valid session is presented as Authorization: Bearer ... or the mars_session cookie. The bearer header takes precedence. Browser cookies are Secure, HttpOnly, and SameSite=Lax. Do not copy tokens into URLs or logs.
Capability map
| Action | Capability |
|---|---|
| Create, update, revoke | publish_entry, update_entry, revoke_entry respectively |
| Offer / accept or decline transfer | transfer_out / transfer_accept |
| Attest / report | attest / report |
| Client federated discovery | federated_discovery |
| Peer self-update | federation_sync |
| Bonds, anchor recovery, deep health, peer diagnostics | admin |
Mutation middleware also enforces idempotency and scope. Possession of a signed entry is not sufficient to obtain these capabilities.
Provisioning
Configure allowed authentication profiles, audience/origin policy, session/challenge durations, and trusted roots with the operator. Validate through the session endpoint. Production startup constructs supported live adapters and rejects invalid credentials/configuration before binding.
Source authority
This page describes the checked-in implementation, not the availability of a public registry.
mars-server/src/auth/principal.rsmars-server/src/auth/handlers.rsmars-server/src/auth/adapters/siws.rsmars-server/src/middleware/auth.rsmars-server/src/api/mod.rs