search

operate-first / blueprint

This is the blueprint for the Operate First Initiative
GNU General Public License v3.0
16 stars 16 forks source link

Authentication for all platform environments #74

Closed durandom closed 3 years ago

tumido commented 3 years ago

Related: #30

durandom commented 3 years ago

We can aggregate them via Keycloak if we want to - offering choice from all the options.

If we aggregate via Keycloak, do we need to maintain a mapping? Right now we have email addresses in our RBAC configs. Is that the ID that keycloak/OCP would use to map a user? How about ID collisions?

tumido commented 3 years ago

@durandom Keycloak can provide various way how to map users if we enable multiple identity providers. It's a pretty mature project so this should be easy to solve. I can prepare a PoC to demonstrate this linking. Usually the emails are the best ID that is transferable across many ID providers, so it make sense to use it as the primary identifier.. However we can try to override that mapping and user GH usernames instead (forcing users to log in via GH on the first login).

I would vote against user option to change usernames, since that would make the ID conflicts possible.

billburnseh commented 3 years ago

Changed assignee as Tom appears to be working this.

HumairAK commented 3 years ago

@durandom can you run pre-commit on this pr? https://github.com/operate-first/apps/blob/master/contributing.md#tests

Also, can you rename the adr to the next number as we already have an adr 15

tumido commented 3 years ago

Since I'm assigned to this and we want to make it fast, I'll update the PR

HumairAK commented 3 years ago

@tumido can you also update the links to the proper format, the brackets are reversed

4n4nd commented 3 years ago

/retest

tumido commented 3 years ago

changes applied. :slightly_smiling_face:

HumairAK commented 3 years ago

/lgtm

sesheta commented 3 years ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tumido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/operate-first/blueprint/blob/main/OWNERS)~~ [tumido] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment