search

citysciencelab / urban-model-platform

This repository contains a prototype for a urban model platform. It is written in Python and implements the OGC API Processes Standard as an execution management service.
GNU General Public License v3.0
10 stars 1 forks source link

Add authentification component #5

Open herzogrh opened 4 months ago

herzogrh commented 4 months ago

There should be an authentification component that handles

  1. authentification of the model platform with different model servers. Currently only BasicAuth is supported, but other model servers should be connectable via different authentification solutions (eg. Bearer Tokens, Digest Auth, ...)
  2. authentification of users connecting to the model platform

There should be a separate identity and access management system (Keycloak) that is connected with the platform.

hwbllmnn commented 3 months ago

The second part is solved with #27

hwbllmnn commented 3 months ago

Regarding the first part, do we have any example servers with different authentication methods to test with?

herzogrh commented 3 months ago

Not yet unfortunately

hwbllmnn commented 2 months ago

@herzogrh Can this issue be closed? Maybe we can reopen this or open a new ticket once new model servers with different authentication methods pop up.

hwbllmnn commented 2 months ago

Note #47 regarding anonymous process access.

hwbllmnn commented 1 month ago

It should be better specified what exactly may happen for anonymous users, e.g. if they run processes, will job results be stored indefinitely? Will layers be created in Geoserver and be stored indefinitely? @herzogrh

hhmric commented 1 month ago

I guess it would be good to add a configurable number of hours until results of unauthorized users are deleted. The deletion should include both the saved results in the database and the layers in the GeoServer component. What do you think, @herzogrh ?

herzogrh commented 1 month ago

Yes I think that's a good solution. I suppose only models which do not require a lot of computational power would be available to unauthorized users, so they would typically receive the results quite fast. Given that, it would be the easiest way if they'd have to wait for their current job, but not see any other jobs that were run by unauthorized users.

hwbllmnn commented 1 month ago

How do we decide which models do not require a lot of computational power, should this not be configurable?

herzogrh commented 1 month ago

Yes, this should be configured