[feature] any plan for implementation: authentication layer

[thinkORo]

For me the authentication layer is the missing feature to use ROAPI in my project(s).
Is there any plan for the implementation? Is there anything I could do?

[houqp]

I am not actively working on auth right now, but I am very open to pull requests.

What kind of auth do you need? You might be able to get it done with a simple nginx reverse proxy too.

[thinkORo]

Hi QP Hou,

unfortunately I'm too new to Rust as I could make a good implementation starting from the beginning.

What I'd looking for: basic authentication (like password.db in Trino) to restrict the access to the system for the first step.
In the second step I'd like to have a basic authorization to restrict some specific data objects for different user or user groups.

I could help by documenting the requirement or by testing the functionality or by creating the documentation.

What do you mean?

[houqp]

Got it, if all you need is basic auth, you could stand up a reverse proxy using nginx as a shorterm workaround, see: https://serverfault.com/questions/230749/how-to-use-nginx-to-proxy-to-a-host-requiring-authentication

[thinkORo]

But I'd need it for all interfaces. Which means this should work for JDBC/ODBC as well. And that's not possible via nginx as faar as I know?

[houqp]

that's correct, for JDBC, nginx based auth won't work.

[elliot14A]

Hey @houqp, I want to work on this.
I'll try to create a simple master-key authentication, where the user(admin) will specify if using a MASTER_KEY env and he can generate access-keys using it. Then the other users who are trying to access roapi will these generated keys.

routes:
POST /access_key requires MASTER_KEY in Authorization Header - create new access key
DELETE /access_key/invalidate requires MASTER_KEY in Authorization Header - invalidates access key

please let me know if this approach is ok.

[houqp]

@elliot14A i recommend starting with something simple that allows users to specify the secret keys in the yaml config. Since roapi doesn't persist any data in data stores, runtime dynamic key registration won't work well because we will lose all the keys on restart/redeploy.

[elliot14A]

@houqp, I was going the implementation of meilisearch https://github.com/meilisearch/meilisearch/tree/main/meilisearch-auth . Should we implement something similar?

[houqp]

@elliot14A you can give it a try, but keep in mind that we don't have ways to persist the dynamically generated key, so it's better to start with supporting static keys