Support for OpenID based authentication

Support for OpenID based authentication

why open id ?

1. enterprise standard to support variety of user flows.
2. connect various to various identity broker like github, ldap
3. All major languages have open id packages

Openfaas currently supports basic authentication. If it has to support openid based auth either

1. gateway has to be changed
2. proxy in front of gateway

To get started we can just have proxy like keycloak gatekeeper in front of openfaas gateway and proxy all requests through it. (No change needed on the gateway)

So what are the changes needed ?

3 ways to connect to openfaas gateway

1. ui
2. api
3. cli

ui - we can use redirect flow, which will redirect to openid providers ui and can login from there
api - bearer token in header
cli - cli is the one which needs change. Need a way to pass bearer token

my proposal

add functionality to the login, similar to openshift login (oc login)

For example

faas login -u -p --gateway=https://openfaasgateway --well-know-url=openidurl client=openidclient

• once logged in the open id token can be stores in the config file.
• every request to gateway made with the token in the header
• once the token expires , alert for login again

Start by reading the existing faas login command and the CLI's configuration and gateway-request handling. The issue proposes OpenID login, token storage, bearer-token requests, and expiry handling, but the gateway-versus-proxy approach and exact scope still need to be decided before implementation.