DependencyTrack / DependencyTrack/dependency-track

Support for oauth2-proxy

Open
#7,141 1 comment 4 reactions 0 assignees View on GitHub
enhancement help wanted p3 size/M
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

For our system we authenticate all connections via oauth2-proxy before they reach the backed. This give us a simple pane of glass when it comes to IT health checks. All authentication for apps that support proxy authentication are done in the same way and we can apply rules to not allow any API traffic without authentication

When is comes to application such a dependency track which support the own implementation of OIDC we need to do much more due dilligance to make sure the service complies with our security standards. We have to allow unauthenticated access to the dependency track apis which make our security team nervous.

### Proposed Behavior

Allow Dependency track to support oauth2-proxy so that a user, once authenticate with the gateway, does not have to do any more actions to access the dashboard.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by mapping Dependency-Track's existing authentication and OIDC flow, then determine how oauth2-proxy would integrate with dashboard and API access; done should mean gateway-authenticated users can access the dashboard without another login while the required security boundaries remain clear.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.