temporalio / temporalio/temporal-proxy
How to handle authz and authn when already using self-hosted deployment ?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 22
- Forks
- 4
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 32
Description
Hello,
I'm using self-hosted deployment with a custom server extended with claimmapper which only extracts subject (either user or service but those are different JWT providers) from JWTs and authorizer which uses a custom RBAC from a YAML file with a difference on cluster permissions and namespace permissions.
If using the proxy, should I implement the external decision endpoint with this logic and removes it from Temporal Server ? Or is it both duplicated in the external decision endpoint and the self hosted deployment ?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin with the proxy's external decision endpoint and the self-hosted deployment's claimmapper and authorizer configuration described in the issue. Determine how JWT providers, cluster permissions, and namespace permissions are expected to interact across the proxy and Temporal Server, then document the supported responsibility boundary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, authorization, backend, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100