Page MenuHomeSoftware Heritage

[POC] Integrate Keycloak to authenticate users and manage permissions
AbandonedPublic

Authored by anlambert on Oct 11 2019, 4:51 PM.

Details

Reviewers
None
Group Reviewers
Reviewers
Summary

That diff is not intended to be landed as is but is rather a proof of concept regarding
the integration of Keycloak in swh-web.

Keycloak is an opensource solution for adding authentication to applications and securing
services with minimum fuss.

Instead of using the Django authentication system, every operations related to users
management are delegated to Keycloak.

That diff is an experiment of using it to authenticate users who make requests to the
swh web api and lift the rate limiting if they have the proper permission.

To test that new feature, you can use the docker-compose environment by following the
instructions located in diff D2131.

Related T2020

Test Plan

TODO, we could mock Keycloak responses by using the python-jose module in the tests implementation.

Diff Detail

Event Timeline

vlorentz added inline comments.
swh/web/common/keycloak.py
119–122

why?

swh/web/common/middlewares.py
94

it shouldn't return a 401 for *all* errors.

Next step: better integrate Keycloak using the Django authentication layer.

Abandonning this POC, proper work now continues in D2746