Does SimDB support keycloak?

[DavidPCoster]

The SimDB server at the Gateway was using the Gateway LDAP. The old LDAP server is being decommissioned (or might already have been decommissioned) and it might not be possible to use the new one. Hence my question -- is it possible to get SimDB to authentic against a keycloak instance?

[olivhoenen]

Something for that was added this year: https://simdb.readthedocs.io/en/latest/search.html?q=keycloak
Maybe @jholloc can tell if this is complete and ready to be used.

[jholloc]

It should be ready to be used. WEST are currently in process of trying to use Keycloak auth so should highlight if any functionality is missing.

[mkowsiak]

We will give it a try in that case. So far, in documentation there were only:

authentication - type - Required (yes )- Name of the authentication method used by the server to authenticate users - current options are [ActiveDirectory, LDAP, None]. See sections below for details of extra options required for the Active Directory and LDAP authentication options.

Can we please ask for detailed instructions on how to configure SimDB with Keycloak as authentication method?

[jholloc]

Yes, the auth documentation needs to be updated. This is what I sent WEST regarding this:

[authentication]
type = KeyCloak
server_url = ...
realm_name = ...
client_id = ...

[jholloc]

You can see what the code is doing here:

https://github.com/iterorganization/SimDB/blob/develop/src/simdb/remote/core/auth/keycloak.py

[mkowsiak]

I can see that this is a part of development branch. Is it already released as tag? Last time we were asked by users to provide only tagged release of SimDB and I don't want to make them upset with development release.

[jholloc]

It's also in the main branch, and was included in the last tagged release:

https://github.com/iterorganization/SimDB/blob/0.13.0/src/simdb/remote/core/auth/keycloak.py

[mkowsiak]

OK - we will give it a try outside of production environment on one of our test machines and let you know whether it works as expected. If it is possible to use this release with Keycloak I don't see any problems in delivering this version connected to PCSS based Keycloak that is linked with EUROfusion AAI.

[adam-parker1]

Note, there is a typo in the keycloak.py file, server_url is actually sever_url a few places

SimDB/src/simdb/remote/core/auth/keycloak.py

Line 19 in 4400f4b

sever_url = config.get_option("authentication.sever_url")

[DavidPCoster]

I have received the following feedback from PCSS:

It means that SimDB uses less secure approach to obtain tickets and our KeyCloak installation do not support this way of authentication. SimDB should be updated to provide more robust, OAuth2.0 authentication. In Direct Access Grants scenario passwords to Keycloak instance are know to third party applications and this is the risk. We can't expose the whole system to the risk for just one case.

How difficult is it to upgrade the KeyCloak authentication mechanism in UDA?

[fcasson]

More information is at https://jira.eufus.psnc.pl/projects/ACH04SUPP/issues/ACH04SUPP-288

[jholloc]

I've just created a new branch on a SimDB fork for this: https://github.com/jholloc/SimDB/tree/feature/oauth2

This has a new OAuth2 authenticator https://github.com/jholloc/SimDB/blob/feature/oauth2/src/simdb/remote/core/auth/oauth2.py

I am hoping this is more OAuth2 compliant but i'm waiting to get it looked over from someone here who knows more about OAuth than me. Happy to take comments.

[dfigat]

In the feature/oauth2 branch I had errors after starting SimDB:

  File "/opt/python/lib/python3.11/site-packages/flask/app.py", line 1502, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/simdb/src/simdb/remote/app.py", line 50, in index
    authenticators = [Authenticator.get(auth_type) for auth_type in authentication_types]
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/simdb/src/simdb/remote/app.py", line 50, in <listcomp>
    authenticators = [Authenticator.get(auth_type) for auth_type in authentication_types]
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: Authenticator.get() missing 1 required positional argument: 'config'

I tried to fix the code:

diff --git a/src/simdb/remote/app.py b/src/simdb/remote/app.py
index 630232e..f328e23 100644
--- a/src/simdb/remote/app.py
+++ b/src/simdb/remote/app.py
@@ -47,7 +47,7 @@ def create_app(
         for ver in blueprints:
             endpoints.append(f"{request.url}{ver}")
         authentication_types = config.get_string_option("authentication.type").split(",")
-        authenticators = [Authenticator.get(auth_type) for auth_type in authentication_types]
+        authenticators = [Authenticator.get(auth_type, config) for auth_type in authentication_types]
         return jsonify(
             {
                 "endpoints": endpoints,
diff --git a/src/simdb/remote/core/auth/__init__.py b/src/simdb/remote/core/auth/__init__.py
index af983da..bf17ebb 100644
--- a/src/simdb/remote/core/auth/__init__.py
+++ b/src/simdb/remote/core/auth/__init__.py
@@ -81,7 +81,7 @@ def check_auth(config: Config, request: Request) -> Optional[User]:
     authentication_types = config.get_option("authentication.type").split(",")
     # authentication_types = ['token'] + authentication_types
     for authentication_type in authentication_types:
-        authenticator = Authenticator.get(authentication_type)
+        authenticator = Authenticator.get(authentication_type, config)
         user = authenticator.authenticate(config, request)
         if user is not None:
             return user

But I still get a 401 when trying to obtain a token from SimDB.
Additionally, SimDB doesn’t redirect me to the Keycloak login page — instead, it asks for a user/password directly in the command line.