Keycloak integration
Thomas Segismont
tsegismo at redhat.com
Wed Jan 7 08:52:48 UTC 2015
Le 05/01/2015 12:23, Juraci Paixão Kröhling a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 01/05/2015 09:36 AM, Thomas Segismont wrote:
>> Yes, we need a custom interceptor which inspects the Subject and
>> makes sure that jdoe at "acme" cannot read metrics from other
>> tenants, even if it has the "metrics-rw" role.
>
> Should this be done as part of this PR, or in the next PR?
Create a new issue would be fine. Offering a new PR would be perfect ;)
>
>> IIRC, we went including the tenant id in the URI precisely to
>> avoid sending it as an HTTP header.
>
> Ok, I'll change the resolver to use the URL when looking for the
> tenant id, instead of the HTTP header.
>
>> Could you think of a solution for the InfluxDB compatible
>> endpoints? Their paths start with "/tenants/{tenant}/influx" and
>> clients must authenticate with query parameters
>> ("?u=root&p=root").
>
> I'd need to take a closer look at InfluxDB and how its auth works. A
> quick look at the documentation tells me that it supports basic auth
> as well, but I'm quite certain that this is not relevant for us :-)
>
Why? Couldn't we allow basic auth over a secured connection?
> By the way, how do you plan to use InfluxDB with regards to auth? Will
> there be an user per tenant, or one InfluxDB user per Metrics user?
Can you please elaborate on the consequences of each alternative?
Thanks!
More information about the rhq-devel
mailing list