Keycloak integration

Thomas Segismont tsegismo at redhat.com
Thu Jan 8 16:36:19 UTC 2015


Le 08/01/2015 15:30, Juraci Paixão Kröhling a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Somehow, I missed this email. Comments inline.
>
> On 01/07/2015 09:52 AM, Thomas Segismont wrote:
>> Le 05/01/2015 12:23, Juraci Paixão Kröhling a écrit :
>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>>
>>> On 01/05/2015 09:36 AM, Thomas Segismont wrote:
>>>> Yes, we need a custom interceptor which inspects the Subject
>>>> and makes sure that jdoe at "acme" cannot read metrics from
>>>> other tenants, even if it has the "metrics-rw" role.
>>>
>>> Should this be done as part of this PR, or in the next PR?
>>
>> Create a new issue would be fine. Offering a new PR would be
>> perfect ;)
>
> Ok, I'll create an issue for it. It's just not clear to me yet how to
> enforce this in an interceptor. Does all responses include a
> "tenantId" or something like that?
>
>>>> IIRC, we went including the tenant id in the URI precisely to
>>>> avoid sending it as an HTTP header.
>>>
>>> Ok, I'll change the resolver to use the URL when looking for the
>>> tenant id, instead of the HTTP header.
>>>
>>>> Could you think of a solution for the InfluxDB compatible
>>>> endpoints? Their paths start with "/tenants/{tenant}/influx"
>>>> and clients must authenticate with query parameters
>>>> ("?u=root&p=root").
>>>
>>> I'd need to take a closer look at InfluxDB and how its auth
>>> works. A quick look at the documentation tells me that it
>>> supports basic auth as well, but I'm quite certain that this is
>>> not relevant for us :-)
>>>
>>
>> Why? Couldn't we allow basic auth over a secured connection?
>
> Because I believe that InfluxDB's user base is different than the main
> user's base. In regular applications, I'd have one set of credentials
> to the database per application, not per user.

This isn't what I had in mind. See details below.

>
>>> By the way, how do you plan to use InfluxDB with regards to auth?
>>> Will there be an user per tenant, or one InfluxDB user per
>>> Metrics user?
>>
>> Can you please elaborate on the consequences of each alternative?
>
> I'm under the impression that the authentication on InfluxDB will be
> done using an application specific set of credentials, not a per-user
> or per-tenant set of credentials.
>
> If my assumption is correct, then the InfluxDB's access would be
> "proxied" via an endpoint in our side, so, the client would
> authenticate just like they would do with any other endpoint. Thus,
> we'd have only one pair of credentials to InfluxDB. As far as I can
> see in the code, we do have a layer between the client and InfluxDB.
>
> But if the intention is to use one set of credentials per tenant or
> per user (user belonging to a tenant), then we'd need to think of a
> way to sync the credentials between Keycloak and InfluxDB.

I don't think we need a separate set for users of the InfluxDB 
endpoints. Users of a tenant should be able to use the primary API and 
the InfluxDB compatible one.

I was insisting on the availability for them to authenticate with query 
params or basic auth when using the InfluxDB API for ease of integration 
with existing InfluxDB client (like the Java client).

That said, the Influx API is still under heavy work and not totally 
ready, so I'm fine with merging the PR as is. Can you log another issue 
- again ;) - so that we come back to this later?


More information about the rhq-devel mailing list