search

Open-EO / openeo-web-editor

An interactive and easy to use web-based editor for the OpenEO API.
https://editor.openeo.org
Apache License 2.0
12 stars 17 forks source link

support OIDC client credentials auth? #324

Open soxofaan opened 5 months ago

soxofaan commented 5 months ago

I'm not sure if this is even remotely feasible, but we recently had several users asking about this, so just putting this here for future reference:

Is it possible to use the openEO web editor with service accounts (which only support the OIDC "client credentials" grant)?

m-mohr commented 5 months ago

This is not really feasible for web apps as client credentials need a client secret, i.e. you'd need to enter client_id and client_secret for every login and then keep the browser open.

What's the usecase for a browser app? Usually a refresh token should cover a long enough time span...

soxofaan commented 5 months ago

The typical use case is users that use client credentials based machine-to-machine auth for non-interactive workflows, but still want to be able to follow up e.g. batch job progress through the web editor.

m-mohr commented 5 months ago

So effectively this would be implemented similar to a username (client ID)/password (client secret) login workflow? This is effectively more an openeo-js-client issue as the underlying OIDC library is the limiting factor.

At some point we need to upgrade from the deprecated oidc-client-js to oidc-client-ts anyway, but it doesn't support client credentials either: https://github.com/authts/oidc-client-ts

So it would need a whole new library and I'm not sure which one would cover all our use cases. So this is a major effort.

soxofaan commented 5 months ago

I'm fine with the current assessment that the effort outweighs the added value at the moment.

To the user interested in a feature like this: I'd like to point out that it is already possible to approximate this feature through Jupyter notebooks and the openEO python client:

image