search

OHDSI / WebAPI

OHDSI WebAPI contains all OHDSI services that can be called from OHDSI applications
Apache License 2.0
126 stars 156 forks source link

Enable OIDC authentication with a direct client #2289

Closed RowanErasmus closed 11 months ago

RowanErasmus commented 1 year ago

The OpenID Connect story continues.

As per this issue #2288 we are trying to access WebAPI programmatically and the current OIDC implementation only allows the code flow through the UI, this adds the option to authenticate with a token supplied by the identity provider.

I think, as far as the needs of EMC go, with this we are now at a fully functional OIDC implementation for WebAPI :-)

anthonysena commented 1 year ago

@RowanErasmus - from discussion on Atlas WG, we'd like to consider these changes in light of the discussion on #1473 and #1884. If your team needs to use this, please use this side-branch you've developed here but we'll want to consider these requirements when we develop the design for those issues.

chrisknoll commented 1 year ago

I think we also discussed that this functionality may have a use-case, so we can incorporate this change for use when you want to authenticate via OID, and the separate functionality of API Keys (which can bypass authentication) which is discussed in the different PR.

@anthonysena , if you agree, can we move forward with merging this PR?

anthonysena commented 1 year ago

I think we also discussed that this functionality may have a use-case, so we can incorporate this change for use when you want to authenticate via OID, and the separate functionality of API Keys (which can bypass authentication) which is discussed in the different PR.

@anthonysena , if you agree, can we move forward with merging this PR?

Agreed - I'll approve this PR with the note that it is handling a specific use-case vs the other referenced issues which is a broader solution.

alondhe commented 11 months ago

Are there any new security parameters we should cover with Broadsea?

chrisknoll commented 11 months ago

I don't believe so. It adds a new path /user/login/openidDirect which can be used for direct API access with OpenID.