feat: token authentication for api access; fix #44 #47
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hahahannes
changed the title
hahahannes
force-pushed
the
token_authentication
branch
from
12e057c to
a6e2b5e
Compare
hahahannes
force-pushed
the
token_authentication
branch
from
a6e2b5e to
c7af7b7
Compare
hahahannes
changed the title
|
@kharkevich Let me know what you think. I tried to make it as generic as possible but it needs more testing for the full feature. Could definitely also add some unittest. |
malleshasc
approved these changes
Nov 5, 2024
|
@hahahannes thanks for inspiring me to make this feature real, could you please check #54 probably it will work for you. Otherwise, please update your PR in accordance with the new project structure |
|
Awesome! I will try to test it soon |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This Pr adds the feature of validating an OAuth/OIDC access token in the
Authorizationheader for authentication. First the presence of a token is checked, then its validity. In case of failure, the original basic auth check is performed. At the moment, I tested it with Keycloak as the Identity Provider and RS256 signed tokens and the public keys that are exposed by keyloack under/protocol/openid-connect/certs