security rework and memory optimilizations.
This commit is contained in:
@@ -0,0 +1,167 @@
|
||||
# OIDC Authentication Configuration
|
||||
|
||||
## Overview
|
||||
|
||||
Core-API has been configured with OIDC authentication support using Authentik as the identity provider. This provides secure authentication for infrastructure management endpoints.
|
||||
|
||||
## Current Status
|
||||
|
||||
**OIDC is currently DISABLED** (`oidc_enabled=false` in config.py)
|
||||
|
||||
This allows:
|
||||
- Internal services to access the API without authentication
|
||||
- Direct API access from the Docker network
|
||||
- Backward compatibility with existing integrations
|
||||
|
||||
## Authentik Configuration
|
||||
|
||||
### Provider Details
|
||||
|
||||
- **Provider Name**: `core-api-provider`
|
||||
- **Provider ID**: `1`
|
||||
- **Client ID**: `core-api`
|
||||
- **Client Secret**: `WfsY0iIVOmO1wvXn1u8jwa08eiQsn2yVf9toBwVyEqps3M98nOZwJMgDOqH5PNZGM6wIxKTwlwYemtaOUg9u5bocd0EqShyoe4yhBQq4SDd0svyArILHZeGHFVEqUi4d`
|
||||
- **Issuer**: `https://auth.schweitz.net/application/o/core-api/`
|
||||
|
||||
### Application Details
|
||||
|
||||
- **Application Name**: `Core API`
|
||||
- **Slug**: `core-api`
|
||||
- **Launch URL**: `http://localhost:8083/docs`
|
||||
|
||||
### Redirect URIs
|
||||
|
||||
- `http://localhost:8083/docs/oauth2-redirect`
|
||||
- `https://core-api.schweitz.net/docs/oauth2-redirect`
|
||||
- `http://192.168.86.149:8083/docs/oauth2-redirect`
|
||||
|
||||
## Enabling OIDC Authentication
|
||||
|
||||
When ready to enable OIDC authentication for external access:
|
||||
|
||||
### 1. Update core-api Configuration
|
||||
|
||||
In `/home/jpmschweitzer/Projects/portainer-core/services/core-api/src/config.py`:
|
||||
|
||||
```python
|
||||
# OIDC Authentication (Authentik)
|
||||
oidc_enabled: bool = True # Change from False to True
|
||||
oidc_issuer: str = "https://auth.schweitz.net/application/o/core-api/"
|
||||
oidc_audience: str = "core-api"
|
||||
oidc_client_secret: str = "WfsY0iIVOmO1wvXn1u8jwa08eiQsn2yVf9toBwVyEqps3M98nOZwJMgDOqH5PNZGM6wIxKTwlwYemtaOUg9u5bocd0EqShyoe4yhBQq4SDd0svyArILHZeGHFVEqUi4d"
|
||||
```
|
||||
|
||||
### 2. Restart core-api
|
||||
|
||||
```bash
|
||||
docker restart core-api
|
||||
```
|
||||
|
||||
### 3. Test Authentication
|
||||
|
||||
1. Visit: http://localhost:8083/docs
|
||||
2. Click the "Authorize" button
|
||||
3. Log in with Google via Authentik
|
||||
4. Access protected endpoints
|
||||
|
||||
## Protected Endpoints
|
||||
|
||||
When OIDC is enabled, the following endpoints require admin authentication:
|
||||
|
||||
### Infrastructure Management (Write Operations)
|
||||
- `POST /infrastructure/services` - Deploy stack
|
||||
- `PUT /infrastructure/services/{name}` - Update stack
|
||||
- `DELETE /infrastructure/services/{name}` - Delete stack
|
||||
- `POST /infrastructure/proxy` - Create proxy host
|
||||
- `POST /infrastructure/services/{name}/stop` - Stop service
|
||||
- `POST /infrastructure/services/{name}/start` - Start service
|
||||
|
||||
### Monitoring Management
|
||||
- `POST /infrastructure/monitors` - Create monitor
|
||||
- `PUT /infrastructure/monitors/{monitor_id}` - Update monitor
|
||||
- `DELETE /infrastructure/monitors/{monitor_id}` - Delete monitor
|
||||
|
||||
### Read Endpoints (Public)
|
||||
All GET endpoints remain publicly accessible:
|
||||
- `/health` - Health check
|
||||
- `/infrastructure/health` - Infrastructure health
|
||||
- `/infrastructure/services` - List services
|
||||
- `/infrastructure/ports` - List ports
|
||||
- `/infrastructure/domains` - List domains
|
||||
- `/infrastructure/monitors` - List monitors
|
||||
|
||||
## Internal Network Access
|
||||
|
||||
**Important**: After enabling OIDC for external users, internal services still need unrestricted access.
|
||||
|
||||
### Future Enhancement Options
|
||||
|
||||
1. **Network-based Authentication**
|
||||
- Check if request originates from `docker-dataplane` network
|
||||
- Allow requests from internal IPs without auth
|
||||
- Require OIDC only for external requests
|
||||
|
||||
2. **Service Accounts**
|
||||
- Create machine tokens for internal services
|
||||
- Use Bearer token authentication for service-to-service calls
|
||||
- Keep OIDC for user authentication
|
||||
|
||||
3. **NPM Proxy Layer**
|
||||
- External domain (https://core-api.schweitz.net) → Requires Authentik SSO
|
||||
- Internal access (http://core-api:8083) → No authentication
|
||||
|
||||
## Admin Groups
|
||||
|
||||
Users must be members of one of these Authentik groups to access protected endpoints:
|
||||
- `admin`
|
||||
- `authentik Admins`
|
||||
|
||||
Configure user group membership in Authentik admin panel:
|
||||
https://auth.schweitz.net/if/admin/#/identity/users
|
||||
|
||||
## Authentik Management
|
||||
|
||||
- **Admin Panel**: https://auth.schweitz.net/if/admin/
|
||||
- **Applications**: https://auth.schweitz.net/if/admin/#/core/applications
|
||||
- **Providers**: https://auth.schweitz.net/if/admin/#/core/providers
|
||||
|
||||
## API Token Management
|
||||
|
||||
The Authentik API token used for automation is stored in:
|
||||
`/home/jpmschweitzer/Projects/portainer-core/services/core-api/src/credentials.py`
|
||||
|
||||
```python
|
||||
AUTHENTIK_CORE_API_TOKEN = "peXM0EzDv2Wiwycbfm3cE5O44IMAOR8ntUwKVP977yFvVopCzDlKY8tymlMM"
|
||||
```
|
||||
|
||||
To create additional tokens: https://auth.schweitz.net/if/admin/#/identity/tokens
|
||||
|
||||
## Security Considerations
|
||||
|
||||
1. **Client Secret**: Stored in config.py (gitignored), consider moving to environment variable
|
||||
2. **Token Validation**: Tokens are validated using JWKS from Authentik
|
||||
3. **Token Expiry**: Access tokens valid for 60 minutes, refresh tokens for 30 days
|
||||
4. **SSL**: All production endpoints should use HTTPS (via NPM)
|
||||
5. **Admin Access**: Restrict admin group membership carefully
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Login Issues
|
||||
- Check Authentik service status: `docker ps | grep authentik`
|
||||
- Check Authentik logs: `docker logs authentik-server`
|
||||
- Verify redirect URIs match exactly in Authentik provider config
|
||||
|
||||
### Token Validation Errors
|
||||
- Verify OIDC issuer URL is correct
|
||||
- Check core-api logs: `docker logs core-api`
|
||||
- Ensure Authentik is accessible from core-api container
|
||||
|
||||
### Permission Denied (403)
|
||||
- Verify user is member of `admin` group in Authentik
|
||||
- Check user claims in JWT token at https://jwt.io
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- **Security Implementation Plan**: `/home/jpmschweitzer/Projects/portainer-core/security-implementation-plan.md`
|
||||
- **SSO Progress**: `/home/jpmschweitzer/Projects/portainer-core/SSO_IMPLEMENTATION_PROGRESS.md`
|
||||
- **Authentik Docs**: https://docs.goauthentik.io/
|
||||
Reference in New Issue
Block a user