Project

General

Profile

Native login implementation » History » Version 4

Tom Clegg, 04/17/2019 06:13 PM

1 1 Tom Clegg
h1. Native login implementation
2
3
Background: sso-provider is a Rails app that provides an OAuth2 interface to OAuth2, LDAP, and local password database backends. It has some problems:
4
* high maintenance cost
5
* high admin cost (install/upgrade/troubleshoot)
6
* unnecessary extra steps in login flow
7
8
Proposal:
9
* Implement the backends in arvados-controller (instead of proxying to RailsAPI and redirecting to sso-provider)
10
* During transition phase, continue to support sso-provider as a backend
11
12
Development/release roadmap:
13 3 Tom Clegg
# Add Google (OpenID Connect) backend as an alternative to sso-provider
14 1 Tom Clegg
# Add LDAP backend as another alternative
15
# Add password database backend -- or, alternatively, suggest installing an LDAP server
16
# Remove sso-provider backend
17
18
Implementation notes:
19 2 Tom Clegg
* https://godoc.org/golang.org/x/oauth2/google, https://godoc.org/golang.org/x/oauth2, https://github.com/coreos/go-oidc
20 1 Tom Clegg
* https://godoc.org/gopkg.in/ldap.v2
21
* https://github.com/korylprince/go-ad-auth wraps ldap to make ActiveDirectory easier -- perhaps we would offer an ActiveDirectory backend as well as a generic LDAP backend?
22 4 Tom Clegg
* Controller will probably need to access the sso-provider's database in order to discover the upstream provider IDs for existing users.