Keycloak integration

Juraci Paixão Kröhling jpkroehling at redhat.com
Thu Jan 8 14:30:52 UTC 2015


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Somehow, I missed this email. Comments inline.

On 01/07/2015 09:52 AM, Thomas Segismont wrote:
> Le 05/01/2015 12:23, Juraci Paixão Kröhling a écrit :
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>> On 01/05/2015 09:36 AM, Thomas Segismont wrote:
>>> Yes, we need a custom interceptor which inspects the Subject
>>> and makes sure that jdoe at "acme" cannot read metrics from
>>> other tenants, even if it has the "metrics-rw" role.
>> 
>> Should this be done as part of this PR, or in the next PR?
> 
> Create a new issue would be fine. Offering a new PR would be
> perfect ;)

Ok, I'll create an issue for it. It's just not clear to me yet how to
enforce this in an interceptor. Does all responses include a
"tenantId" or something like that?

>>> IIRC, we went including the tenant id in the URI precisely to 
>>> avoid sending it as an HTTP header.
>> 
>> Ok, I'll change the resolver to use the URL when looking for the 
>> tenant id, instead of the HTTP header.
>> 
>>> Could you think of a solution for the InfluxDB compatible 
>>> endpoints? Their paths start with "/tenants/{tenant}/influx"
>>> and clients must authenticate with query parameters 
>>> ("?u=root&p=root").
>> 
>> I'd need to take a closer look at InfluxDB and how its auth
>> works. A quick look at the documentation tells me that it
>> supports basic auth as well, but I'm quite certain that this is
>> not relevant for us :-)
>> 
> 
> Why? Couldn't we allow basic auth over a secured connection?

Because I believe that InfluxDB's user base is different than the main
user's base. In regular applications, I'd have one set of credentials
to the database per application, not per user.

>> By the way, how do you plan to use InfluxDB with regards to auth?
>> Will there be an user per tenant, or one InfluxDB user per
>> Metrics user?
> 
> Can you please elaborate on the consequences of each alternative?

I'm under the impression that the authentication on InfluxDB will be
done using an application specific set of credentials, not a per-user
or per-tenant set of credentials.

If my assumption is correct, then the InfluxDB's access would be
"proxied" via an endpoint in our side, so, the client would
authenticate just like they would do with any other endpoint. Thus,
we'd have only one pair of credentials to InfluxDB. As far as I can
see in the code, we do have a layer between the client and InfluxDB.

But if the intention is to use one set of credentials per tenant or
per user (user belonging to a tenant), then we'd need to think of a
way to sync the credentials between Keycloak and InfluxDB.

- - Juca.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJUrpScAAoJECKM1e+fkPrXCXYH/24VUYm19sbWUtS475sfu2li
j7hYgdjA/jcsdbsuvdX0U+vKGSuA0yg278pNBNE1JvKJA1BpwehFFcI9ZXLxIZ1x
QL8PXP4tY1oqGmW9kTLOfUt5j5F0/DbILkv9xIpr21V/zGFuvQrpk1uFVCm3w0KK
lu75wHhD0wtJ5EJocOBbArTSSk84QG/jR5nLTpl3Bi4dn1EoEJnaPWDjVekDgiNx
lOyu3GKJavnIWwYtHnf+e2XdCsCyV3XCkhSNxtyUvzxnn4cw2ZeyiJkDD1zP7mzL
xV3iXHHg0jDNjklcb/NuA7PqE1hNLIFjMGx7RQaly4sRt0feNulPwvmGhcS20OA=
=YzNb
-----END PGP SIGNATURE-----


More information about the rhq-devel mailing list