search

cylc / cylc-ui

Web app for monitoring and controlling Cylc workflows
https://cylc.github.io
GNU General Public License v3.0
37 stars 27 forks source link

Add authentication #2

Closed kinow closed 5 years ago

kinow commented 5 years ago

Probably initially with a dummy authentication. Could even copy the JupyterHub dummy authenticator.

Then we need to confirm:

kinow commented 5 years ago

Creating a permissions layer is a bit complicated, and error-prone. Would be easier to use an existing library/framework for that.

There are two good candidates for the Cylc web interface, with support for Vue (and some people sharing their use cases, implementation details, etc).

kinow commented 5 years ago

For authentication, JWT was mentioned in the meeting in Melbourne. Having a bit of experience with a couple projects that use JWT, I remember other devs had (hard) to work on expiration mechanisms, token refreshing, and storing the tokens in DB and/or caching servers.

Furthermore, these articles though they may seem a bit biased against JWT, present valid issues when using JWT.

As Cylc is not supposed to be exposed publicly in the Internet, and performance (consequently request/response size) are important, I think JWT may not be the best option for us.

Furthermore, if we start from another perspective, trying first to thing whether we could do with simple Cookie's and session for managing the user data... I can't see a reason that would prevent us of going with this approach right now (but could be wrong).

We just need to make sure to encrypt the cookies, use the right settings for security, and also apply TLS for communication.

hjoliver commented 5 years ago

Sounds pretty convincing :+1:

kinow commented 5 years ago

JupyterHub contains a dummy auth. Would be nice to have something for the UI too. Something that can be used when the UI is generated, regardless of the backend. e.g. https://github.com/cornflourblue/vue-vuex-registration-login-example/blob/master/src/_helpers/fake-backend.js

kinow commented 5 years ago

In the end, we may not require authentication here. We could rely entirely on the Hub for that.

The hub will put a secure cookie, that we can use to query information about the user from the Hub. If the cookie is valid, i.e. the hub returns information, then we consider the user authenticated.

Authorization is still an open topic.

kinow commented 5 years ago

After the work done in #33 , I believe we won't need to worry about implementing authentication in the UI server, and for now will try to delegate that to be done by the Hub :tada:

hjoliver commented 5 years ago

That's great ... exactly what we hoped!