Keycloak integration

Juraci Paixão Kröhling jpkroehling at redhat.com
Mon Jan 5 11:23:17 UTC 2015


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/05/2015 09:36 AM, Thomas Segismont wrote:
> Yes, we need a custom interceptor which inspects the Subject and
> makes sure that jdoe at "acme" cannot read metrics from other
> tenants, even if it has the "metrics-rw" role.

Should this be done as part of this PR, or in the next PR?

> IIRC, we went including the tenant id in the URI precisely to
> avoid sending it as an HTTP header.

Ok, I'll change the resolver to use the URL when looking for the
tenant id, instead of the HTTP header.

> Could you think of a solution for the InfluxDB compatible
> endpoints? Their paths start with "/tenants/{tenant}/influx" and
> clients must authenticate with query parameters
> ("?u=root&p=root").

I'd need to take a closer look at InfluxDB and how its auth works. A
quick look at the documentation tells me that it supports basic auth
as well, but I'm quite certain that this is not relevant for us :-)

By the way, how do you plan to use InfluxDB with regards to auth? Will
there be an user per tenant, or one InfluxDB user per Metrics user?

- - Juca.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJUqnQlAAoJECKM1e+fkPrX9WwH/1XIB//yGr6kDlqiAoY1ik4m
S0TyI+62WFEQs9W/UEPki0+Thw7dt+rxrQGnHIJ+7FvAn1ozbt7Y+oPtMH8wZ2zs
dGMfTUcvjcmHq4Ker74JGVRM5WRbE+Ieyw0D/9EATMDuI6RiY7pnOQKrU62zGajD
xI10UeQh5BXkcISm+a6S3MQGx+Hr+prhq4mS3ydJgZzlYBZre/tXm7URswiTg3bR
uuW2EjuUfD0JkDimFrbwOK7YEmqua5HG7kO+SUqGBOaXfAZ1h7aCccJVyGe8rNuc
89TLg6XmaUFWY4LAu9KBwP65OSkrD/KczaKJlGplTrg06IpJl/SXScb4ifdylE8=
=xYLj
-----END PGP SIGNATURE-----


More information about the rhq-devel mailing list