Differential D5361 Diff 19207 docs/authentication.rst

Changeset View

Standalone View

docs/authentication.rst

This file was added.

				.. _authentication:

				Authentication
				==============

				This is a description of the authentication mechanism used in the deposit server.

				Keycloak
				--------

				Recent changes introduced `keycloak`_, an Open Source Identity and Access Management
				which is already used in other part of the swh stack.
				anlambertUnsubmitted Not Done Inline Actions other parts anlambert: other parts

				The authentication is plainly delegated to the swh keycloak instance. If keycloak
				authorizes the deposit client, the deposit further checks that the deposit client has
				the proper role "swh.deposit.api".
				anlambertUnsubmitted Not Done Inline Actions you should use permission instead of role anlambert: you should use permission instead of role

				If any issues arise during one of the authentication check, the client receives a 401
				response (unauthorized).

				.. figure:: images/deposit-authentication-keycloak.svg
				:alt: Keycloak Authentication

				Basic
				-----

				The first implementation used basic authentication. The deposit storage backend has the
				responsibility to check the authentication credential sent by the deposit client. If
				anlambertUnsubmitted Not Done Inline Actions credentials anlambert: credentials
				authorized, the deposit client is authorized to continue its deposit. Otherwise, a 401
				anlambertUnsubmitted Not Done Inline Actions is allowed (to avoid the repetition) anlambert: is allowed (to avoid the repetition)
				response is returned to the client.

				.. figure:: images/deposit-authentication-basic.svg
				:alt: Basic Authentication


				.. _keycloak: https://www.keycloak.org/