feat(React SSO): Support simple OIDC authentication in React #2190
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Scope
This change impacts on the React application / GQL API served from
datahub-frontend
Changes
This PR introduces changes required to support OIDC authentication in the DataHub React app. We build on top of Pac4j, a popular authentication + security library for Java. This will permit us to extend to support other auth methods like LDAP direct, SAML, among others as we evolve the app.
I've enabled this flow via the introduction of a new "/authenticate" endpoint in the Play server which the React application delegates to in order to perform authentication. In essence, this endpoint provides server-driven instruction about how to handle the auth flow. In cases where OIDC is not enabled, a simple redirect to the traditional JAAS login experience is performed. In cases where OIDC is enabled, a redirect to the configured Identity Provider is issued if the current request is not authenticated. This initiates an indirect flow wherein the Identity Provider is delegated auth responsibility, and redirects back to DataHub on successful authentication of an end user. DataHub subsequently fetches the user's profile attributes and extracts a DataHub username from this information. Finally, DataHub sets 2 authentication cookies, one visible within the client app and another invisible.
A major change introduces in this PR is removal of the LogIn mutation from the GQL API exposed within
datahub-frontend
. Now, the entire GQL API is protected by an authentication blanket. This makes is easier for the server to drive the authentication experience based on how it is configured and ensures that the GQL is completely secure.For detailed information about configuring OIDC auth, see react-oidc.md.
Validation
The OIDC flow has been E2E validated using Okta & Google.
Checklist