SPIKE: keycloak for every site and delegated credentials
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 7
- Forks
- 2
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 3
Description
We've stated our desire to use keycloak for all sites, for consistency and composability (it can support any idp backend a customer uses).
Having said that, we're likely to hit a wall with deeper oauth integrations that workbench and connect use, like delegated azure credentials for workbench. These require workbench to use an oauth provider directly to support user impersonation (and other things I don't yet understand).
Can we somehow insert keycloak between the upstream idp and workbench/connect while still retaining the ability to light up these features? If not today, is there a path to do this some day? Assuming there is no path, how should we decide going forward when to -- and when not to -- use keycloak for a customer site?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading linked issue 1741 and the delegated Azure credentials documentation for Workbench. Compare Keycloak's proposed position between the upstream identity provider and Workbench/Connect with the OAuth and impersonation requirements described here. Done means documenting feasibility, a possible future path, and criteria for when a customer site should or should not use Keycloak.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100