-
Notifications
You must be signed in to change notification settings - Fork 27
Python SDK for authentication was keycloak and for other admin services #8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…authentication and admin operations
machristie
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks pretty good @aarushiibisht . I've added a couple comments. Let me know if you have any questions.
| # limitations under the License. | ||
| # | ||
|
|
||
| KEYCLOAK_AUTHORIZE_URL = 'https://localhost:8443/auth/realms/default/protocol/openid-connect/auth' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think a settings.py script is ideal for a library. This pattern works pretty well for a Django application because the developers will just edit as needed. But consumers of the Custos Python SDK won't have a good way to edit this as needed. I think instead we could either:
- Have a Settings class with default values and the client can instantiate it and override those values and then pass in that instance as a parameter or maybe register it
- Read settings from a settings file. You can use the configparser to load an
.inistyle config file. There could be a default location for the file and/or the location of the file could be passed in as a parameter
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Using configparser to load .ini file. Location of the configuration file will be passed as an argument
| from airavata_custos import settings | ||
|
|
||
|
|
||
| class KeycloakBackend(object): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think you'll need a method to initiate the redirect flow, unless you are planning on doing that in a separate PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not sure about what the redirect flow is. I have added 3 flows 1) user_authentication: when user name and password are given 2) account_authentication: when the service account client id and client credentials are supplied 3) refresh token: when user/account is already authenticated
My understanding is the redirect flow is when clientId and client credentials are supplied ie option2 account_authentication. Please correct me if I am wrong.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are two parts to the redirect flow:
- Redirect to the IdP
- Process the response
You've implemented the second one. We could also have a utility code for generating the approach redirection URL for initiating the first part.
In the Django portal, setting up the redirect URL is handled here: https://github.com/apache/airavata-django-portal/blob/master/django_airavata/apps/auth/views.py#L42
machristie
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @aarushiibisht, these changes look really good! I've added some comments and requested changes, if you could please address those at your convenience.
…y_changes Custos sharing registry changes
No description provided.