Refactor auth-service /auth Endpoint for UMA-Based Authorization #28

New Issue

2025-06-03T23:06:43Z

abed.alrahman commented

2025-06-03 23:06:43 +00:00

Goal: Modify the /auth endpoint in auth-service to perform endpoint authorization by making UMA (User-Managed Access) permission evaluation requests to Keycloak, instead of checking for pre-defined client roles.
Brief Description: The /auth endpoint, used by Traefik for forward authentication, needs to be updated. When a request comes for a backend service, /auth will:

Validate the user's token.
Identify the target backend service (which acts as a Keycloak Resource Server), the specific resource (API path), and the scope (HTTP method) being accessed.
Make a permission evaluation request (e.g., by requesting an RPT or using the UMA evaluation endpoint) to Keycloak against the target service's Resource Server configuration.
Respond 200 OK (with user metadata headers) to Traefik if Keycloak grants permission, or 401/403 if denied. This requires auth-service to be configured to understand how to map incoming requests to Keycloak resources/scopes defined by backend services.

Goal: Modify the /auth endpoint in auth-service to perform endpoint authorization by making UMA (User-Managed Access) permission evaluation requests to Keycloak, instead of checking for pre-defined client roles. Brief Description: The /auth endpoint, used by Traefik for forward authentication, needs to be updated. When a request comes for a backend service, /auth will: Validate the user's token. Identify the target backend service (which acts as a Keycloak Resource Server), the specific resource (API path), and the scope (HTTP method) being accessed. Make a permission evaluation request (e.g., by requesting an RPT or using the UMA evaluation endpoint) to Keycloak against the target service's Resource Server configuration. Respond 200 OK (with user metadata headers) to Traefik if Keycloak grants permission, or 401/403 if denied. This requires auth-service to be configured to understand how to map incoming requests to Keycloak resources/scopes defined by backend services.

abed.alrahman added the

labels 2025-06-03 23:06:43 +00:00

abed.alrahman added a new dependency 2025-06-03 23:07:09 +00:00

#9 Design the Group/Tenant Feature

abed.alrahman added

State

Verified

Points