[Feature]: Support OpenId Connect Identity Provider

raffaeler commented 5 months ago

Feature request

I see from the tests and from this issue that DAB already supports JWT authentication and authorization, but I was not able to find any configuration detail for that.

This is a feature request requiring two consecutive steps:

Provide documentation on how to specify the client secret and the other configuration details to spend a JWT token created by an external Identity Provider
Provide extended support for OpenId Connect standard (which is well supported in .NET) so that all the configuration details can be inherited from the metadata endpoint of the Identity Provider supporting OpenId Connect.

The ultimate goal is to make DAB nicely play with Keycloak Identity Provider in container. Keycloak supports federation to external Identity Providers and allows to transform the claimset coming from external IPs making easier to add any cloud provider like Microsoft, Cognito, Google, GitHub, etc.

Version

1.1.7

What database are you using?

Azure SQL

What hosting model are you using?

Local (including CLI), Custom Docker host

Which API approach are you accessing DAB through?

REST, GraphQL

Relevant log output

No response

Code of Conduct

[X] I agree to follow this project's Code of Conduct

seantleonard commented 5 months ago

Thank you for your feedback, @raffaeler

Can you provide more details about the end-to-end workflow you want DAB to support?

Is your intention that DAB reach out to Keycloak for validating any JWT tokens supplied to DAB? If so, this config shows how you configure DAB's IssuerURI (to retrieve signing keys, etc), and specify the client ID : https://learn.microsoft.com/azure/data-api-builder/reference-configuration#json-web-tokens-host-runtime

{
  "runtime": {
    "host": {
      "authentication": {
        "jwt": {
          "audience": "<string>",
          "issuer": "<string>"
        }
      }
    }
  }
}

Or your intention for DAB to validate any tokens minted by the list of providers: "Microsoft, Cognito, Google, GitHub, etc."
- If so, the request seems related to #719 which is on the backlog.

raffaeler commented 5 months ago

Thanks for your answer @seantleonard

For the first step, I just need to validate the JWT. I already knew the web page you linked but I am not familiar with Azure Static Web Apps. I recognize the "runtime", "host" and "authentication" sections but I am not sure where I should save the config file when I run dab (or when starting it in a container). In traditional asp.net core apps, when I configure the webapi to use JWT auth, I usually use the client secret to validate the token. Let me understand this other flow please.

For the step 2, I need to authenticate the developer accessing the data interactively. This includes the swagger and graphql pages. In this case, the OpenId Connect support would open to any modern IP. Just to be clear, I don't want dab to directly redirect to external providers like Microsoft, Cognito, Google and GitHub. I need to pass through Keycloak because it gives me the ability to "refactor" the claims which are different on each provider. It also gives me the ability to use KC APIs for administrative purposes and much more.

Thanks

rodwin commented 5 months ago

I am exactly looking for the same information on how to integrate other identity provider like keycloak

raffaeler commented 5 months ago

@seantleonard Could you please tell me whether point 1 of my original message is already doable? I don't see any mention in the code to the client secret to make DAB decode the JWT and evaluate the claims. Thanks!

theo-auffeuvre commented 1 month ago

I am very interessed about this feature too ! (@raffaeler did you find a work around ?)

raffaeler commented 1 month ago

@theo-auffeuvre unfortunately not and unfortunately this is one of the two issues that blocked us to use this great tool

Azure / data-api-builder