keycloak identity providers handling and considerations

[jmergy]

@kfogel @bickelj I could see the need/want to just leverage the keycloak identity providers as we ramp on end users into the next phases of the work and the apps leveraging the auth vs. creation of direct users in keycloak. Just creating this to raise any concerns on what provisioning does that way vs. direct users as it relates to roles, permissions, etc. in PDC.

[jmergy]

[bickelj]

With today's upgrade to Keycloak 26, a new feature is available: Organizations.

I think that feature should help us do all the things we need to do. See also PhilanthropyDataCommons/service#1291

[bickelj]

@jmergy Would you be willing to try it with your organization and its authentication to explore? I can create the organization, set the domain, etc. We might have to change email addresses or something on existing users to better experiment, but I think it should be fairly straightforward.

[jmergy]

Sure. Don't want to add more you the plate here but I do think it will help adoption later.

[jmergy]

I can take on testing with the ones I know we will be hit with in MS and Google.

[jmergy]

@bickelj I think we should use a separate domain. We can use the PDC domain. I will come back with the plan.

[jmergy]

@bickelj @slifty @kfogel

First cut at adapting the keycloak identity broker diagram from https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/identity-broker/overview.html

sequenceDiagram
    participant User as PDC User
    participant PDC_Application as PDC Application
    participant PDC_Keycloak as PDC Keycloak
    participant IdentityProvider as Identity Provider

    User->>PDC_Application: 1. Request Resource
    PDC_Application->>User: 2. Authentication Request
    User->>PDC_Keycloak: 3. List of Identity Providers
    User->>PDC_Keycloak: 4. Select Identity Provider
    PDC_Keycloak->>IdentityProvider: 5. Authentication Request
    IdentityProvider->>User: 6. Challenge Credentials / Consent
    User->>IdentityProvider: Submit Credentials / Consent
    IdentityProvider->>PDC_Keycloak: 7. Authentication Response
    PDC_Keycloak->>PDC_Application: 8. Local Authentication / Identity Federation
    PDC_Application->>User: 9. Authentication Response
    PDC_Application->>User: 10. Allow access to requested resource

Loading

[bickelj]

@jmergy https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker_overview source is https://github.com/keycloak/keycloak.github.io/blob/e83da028c2fe87d7e6657fbbe9ed49ecc4853b85/index.html#L143. I don't know how hard it would be for them to integrate mermaid but I think it's worth submitting a PR after we try out brokering.

[bickelj]

Update: we will not display the list of available IdPs to the user, rather, the user must log in with an email address. When the email address matches a domain associated with an organization, and that organization is linked by the same domain to an external IdP, the user will then authenticate with that external IdP and then have a valid PDC Keycloak session.

[bickelj]

We now have IdP brokering enabled for at least one organization and documentation for how to enable it for three providers, see https://github.com/PhilanthropyDataCommons/service/blob/0f0a7496cf1699f47e0a3e53c70b1b20486dd0f0/docs/onboarding/ORGANIZATION_IDP_INTEGRATION.md.