Researcher Portal client should access Researcher IdP confidentially

[sh-ura]

As a developer responsible for a system of interacting microservices, I want to ensure that my microservices know and trust each other, so that service A only shares sensitive data with service B when it is reasonably confident in service B's identity. For example, I don't want my Keycloak IdP sharing user authentication information in response to requests from random, unknown clients. I want to avoid these public types of access.

The Researcher IdP should be configured to only allow confidential access to the Researcher Portal client. With the confidential access type and Client Id and Secret authenticator, the Researcher IdP will expect the Researcher Portal to know a shared secret. The Researcher Portal can use this shared secret to authenticate itself.

Acceptance Criteria

• [ ] The Researcher Portal client has the confidential access type and Client Id and Secret client authenticator
• [ ] There is a RESEARCHER_PORTAL_OIDC_CLIENT_SECRET environment variable used by the Researcher Portal to authenticate with Keycloak during the Login process.
• [ ] The compose README includes steps for populating the Researcher Portal client secret (when trying to spin up the Researcher Portal and Researcher IdP together.)

Tips and Tricks

Generating the secret: The client secret can be generated in Keycloak by navigating to Clients > researcher-portal-client, setting Access Type to confidential, navigating to the Credentials tab, and clicking Regenerate Secret.

Environment variables with Docker: You can pass environment variables to a Docker container using the environment field in your docker-compose.yaml.

Authenticating clients via HTTP: Simple key-value pairs containing authentication information can be passed in an HTTP Header (ex. the Authorization header.) You will not need to touch JWTs at all for this task. Check out the Mozilla HTTP Authentication docs here.

[sh-ura]

Won't do. Setting access type to confidential causes CORS issues that are not worth resolving at this point in time, for demo 1.