Authentication in API

[mik-laj]

Description

We should prepare an authentication mechanism that allows easy extension and adding a new authentication method.

More information about REST API:
#8107

Use case / motivation

The purpose of authentication is to achieve a certain level of confidence that the entity is in fact the one it claims to be. Extending authentication methods allows the security requirements of various organizations to be met.

PR does not need to implement any common authentication mechanism. All they have to do is accept the user ID in the request and log in.

Related Issues

N/A

[mik-laj]

I think we can add a simple decorator that will call functions before handling requests. This function will be responsible for checking the credentials and setting the user attribute in the flask context. FAB and flask_login work in the same way, so we will be able to create a delegate some operation to it. This should not be the only way to introduce a new authorization method. We should be as independent as possible from third-party libraries. However, if possible, we should optionally support their use.

A simple code example that authenticates a user with an HTTP header may look like this.

from flask import request, g

REMOTE_USER_HEADER = 'REMOTE_USER'

username = request.headers.get(REMOTE_USER_HEADER)
if not username:
    raise AuthenticationProblem(
        403, "Forbidden", f"Header {REMOTE_USER_HEADER} is missing in
the request"
    )

if not request.authorization:
    user = current_app.appbuilder.sm.auth_user_remote_user(username)
    if user is None:
        raise AuthenticationProblem(
            403, "Forbidden", f"Not authorized"
        )
    log.info("User authorized: %s", user)
    g.user = user

[jhtimmins]

@mik-laj I'm interested in taking over this task. Is the API at a stage where this would be helpful?

[mik-laj]

@jhtimmins I wanted to start working on the core today or Wednesday. However, if you have time, you can start working.

[jhtimmins]

@mik-laj Cool. Do you mean the core of authentication or the core of the API?

[mik-laj]

@jhtimmins Authorization core, i.e. one authorization mechanism (e.g. via HTTP headers) and the ability to choose others using the configuration options.

[jhtimmins]

Gotcha, thanks. Is this issue the best place to discuss the design? Thinking I can design interface and 1-2 implementations.

[mik-laj]

Yes. We can discuss it here. If we want to have more opinions, we can ask on the mailing list later. For non-key design discussions, Github is a good place. If you prefer, you can also create a draft PR.