168 lines
5.6 KiB
Markdown
168 lines
5.6 KiB
Markdown
# OIDC Authentication Configuration
|
|
|
|
## Overview
|
|
|
|
Core-API has been configured with OIDC authentication support using Authentik as the identity provider. This provides secure authentication for infrastructure management endpoints.
|
|
|
|
## Current Status
|
|
|
|
**OIDC is currently DISABLED** (`oidc_enabled=false` in config.py)
|
|
|
|
This allows:
|
|
- Internal services to access the API without authentication
|
|
- Direct API access from the Docker network
|
|
- Backward compatibility with existing integrations
|
|
|
|
## Authentik Configuration
|
|
|
|
### Provider Details
|
|
|
|
- **Provider Name**: `core-api-provider`
|
|
- **Provider ID**: `1`
|
|
- **Client ID**: `core-api`
|
|
- **Client Secret**: `WfsY0iIVOmO1wvXn1u8jwa08eiQsn2yVf9toBwVyEqps3M98nOZwJMgDOqH5PNZGM6wIxKTwlwYemtaOUg9u5bocd0EqShyoe4yhBQq4SDd0svyArILHZeGHFVEqUi4d`
|
|
- **Issuer**: `https://auth.schweitz.net/application/o/core-api/`
|
|
|
|
### Application Details
|
|
|
|
- **Application Name**: `Core API`
|
|
- **Slug**: `core-api`
|
|
- **Launch URL**: `http://localhost:8083/docs`
|
|
|
|
### Redirect URIs
|
|
|
|
- `http://localhost:8083/docs/oauth2-redirect`
|
|
- `https://core-api.schweitz.net/docs/oauth2-redirect`
|
|
- `http://192.168.86.149:8083/docs/oauth2-redirect`
|
|
|
|
## Enabling OIDC Authentication
|
|
|
|
When ready to enable OIDC authentication for external access:
|
|
|
|
### 1. Update core-api Configuration
|
|
|
|
In `/home/jpmschweitzer/Projects/portainer-core/services/core-api/src/config.py`:
|
|
|
|
```python
|
|
# OIDC Authentication (Authentik)
|
|
oidc_enabled: bool = True # Change from False to True
|
|
oidc_issuer: str = "https://auth.schweitz.net/application/o/core-api/"
|
|
oidc_audience: str = "core-api"
|
|
oidc_client_secret: str = "WfsY0iIVOmO1wvXn1u8jwa08eiQsn2yVf9toBwVyEqps3M98nOZwJMgDOqH5PNZGM6wIxKTwlwYemtaOUg9u5bocd0EqShyoe4yhBQq4SDd0svyArILHZeGHFVEqUi4d"
|
|
```
|
|
|
|
### 2. Restart core-api
|
|
|
|
```bash
|
|
docker restart core-api
|
|
```
|
|
|
|
### 3. Test Authentication
|
|
|
|
1. Visit: http://localhost:8083/docs
|
|
2. Click the "Authorize" button
|
|
3. Log in with Google via Authentik
|
|
4. Access protected endpoints
|
|
|
|
## Protected Endpoints
|
|
|
|
When OIDC is enabled, the following endpoints require admin authentication:
|
|
|
|
### Infrastructure Management (Write Operations)
|
|
- `POST /infrastructure/services` - Deploy stack
|
|
- `PUT /infrastructure/services/{name}` - Update stack
|
|
- `DELETE /infrastructure/services/{name}` - Delete stack
|
|
- `POST /infrastructure/proxy` - Create proxy host
|
|
- `POST /infrastructure/services/{name}/stop` - Stop service
|
|
- `POST /infrastructure/services/{name}/start` - Start service
|
|
|
|
### Monitoring Management
|
|
- `POST /infrastructure/monitors` - Create monitor
|
|
- `PUT /infrastructure/monitors/{monitor_id}` - Update monitor
|
|
- `DELETE /infrastructure/monitors/{monitor_id}` - Delete monitor
|
|
|
|
### Read Endpoints (Public)
|
|
All GET endpoints remain publicly accessible:
|
|
- `/health` - Health check
|
|
- `/infrastructure/health` - Infrastructure health
|
|
- `/infrastructure/services` - List services
|
|
- `/infrastructure/ports` - List ports
|
|
- `/infrastructure/domains` - List domains
|
|
- `/infrastructure/monitors` - List monitors
|
|
|
|
## Internal Network Access
|
|
|
|
**Important**: After enabling OIDC for external users, internal services still need unrestricted access.
|
|
|
|
### Future Enhancement Options
|
|
|
|
1. **Network-based Authentication**
|
|
- Check if request originates from `docker-dataplane` network
|
|
- Allow requests from internal IPs without auth
|
|
- Require OIDC only for external requests
|
|
|
|
2. **Service Accounts**
|
|
- Create machine tokens for internal services
|
|
- Use Bearer token authentication for service-to-service calls
|
|
- Keep OIDC for user authentication
|
|
|
|
3. **NPM Proxy Layer**
|
|
- External domain (https://core-api.schweitz.net) → Requires Authentik SSO
|
|
- Internal access (http://core-api:8083) → No authentication
|
|
|
|
## Admin Groups
|
|
|
|
Users must be members of one of these Authentik groups to access protected endpoints:
|
|
- `admin`
|
|
- `authentik Admins`
|
|
|
|
Configure user group membership in Authentik admin panel:
|
|
https://auth.schweitz.net/if/admin/#/identity/users
|
|
|
|
## Authentik Management
|
|
|
|
- **Admin Panel**: https://auth.schweitz.net/if/admin/
|
|
- **Applications**: https://auth.schweitz.net/if/admin/#/core/applications
|
|
- **Providers**: https://auth.schweitz.net/if/admin/#/core/providers
|
|
|
|
## API Token Management
|
|
|
|
The Authentik API token used for automation is stored in:
|
|
`/home/jpmschweitzer/Projects/portainer-core/services/core-api/src/credentials.py`
|
|
|
|
```python
|
|
AUTHENTIK_CORE_API_TOKEN = "peXM0EzDv2Wiwycbfm3cE5O44IMAOR8ntUwKVP977yFvVopCzDlKY8tymlMM"
|
|
```
|
|
|
|
To create additional tokens: https://auth.schweitz.net/if/admin/#/identity/tokens
|
|
|
|
## Security Considerations
|
|
|
|
1. **Client Secret**: Stored in config.py (gitignored), consider moving to environment variable
|
|
2. **Token Validation**: Tokens are validated using JWKS from Authentik
|
|
3. **Token Expiry**: Access tokens valid for 60 minutes, refresh tokens for 30 days
|
|
4. **SSL**: All production endpoints should use HTTPS (via NPM)
|
|
5. **Admin Access**: Restrict admin group membership carefully
|
|
|
|
## Troubleshooting
|
|
|
|
### Login Issues
|
|
- Check Authentik service status: `docker ps | grep authentik`
|
|
- Check Authentik logs: `docker logs authentik-server`
|
|
- Verify redirect URIs match exactly in Authentik provider config
|
|
|
|
### Token Validation Errors
|
|
- Verify OIDC issuer URL is correct
|
|
- Check core-api logs: `docker logs core-api`
|
|
- Ensure Authentik is accessible from core-api container
|
|
|
|
### Permission Denied (403)
|
|
- Verify user is member of `admin` group in Authentik
|
|
- Check user claims in JWT token at https://jwt.io
|
|
|
|
## Related Documentation
|
|
|
|
- **Security Implementation Plan**: `/home/jpmschweitzer/Projects/portainer-core/security-implementation-plan.md`
|
|
- **SSO Progress**: `/home/jpmschweitzer/Projects/portainer-core/SSO_IMPLEMENTATION_PROGRESS.md`
|
|
- **Authentik Docs**: https://docs.goauthentik.io/
|