Keycloak integration

Thomas Segismont tsegismo at redhat.com
Wed Jan 7 08:52:48 UTC 2015


Le 05/01/2015 12:23, Juraci Paixão Kröhling a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 01/05/2015 09:36 AM, Thomas Segismont wrote:
>> Yes, we need a custom interceptor which inspects the Subject and
>> makes sure that jdoe at "acme" cannot read metrics from other
>> tenants, even if it has the "metrics-rw" role.
>
> Should this be done as part of this PR, or in the next PR?

Create a new issue would be fine. Offering a new PR would be perfect ;)

>
>> IIRC, we went including the tenant id in the URI precisely to
>> avoid sending it as an HTTP header.
>
> Ok, I'll change the resolver to use the URL when looking for the
> tenant id, instead of the HTTP header.
>
>> Could you think of a solution for the InfluxDB compatible
>> endpoints? Their paths start with "/tenants/{tenant}/influx" and
>> clients must authenticate with query parameters
>> ("?u=root&p=root").
>
> I'd need to take a closer look at InfluxDB and how its auth works. A
> quick look at the documentation tells me that it supports basic auth
> as well, but I'm quite certain that this is not relevant for us :-)
>

Why? Couldn't we allow basic auth over a secured connection?

> By the way, how do you plan to use InfluxDB with regards to auth? Will
> there be an user per tenant, or one InfluxDB user per Metrics user?

Can you please elaborate on the consequences of each alternative?

Thanks!


More information about the rhq-devel mailing list