Cannot authenticate into Coldfront using the OIDC client credential or device authorization flow

[QuanMPhm]

With the OIDC client credential and device authorization flow, we can obtain an access code from Keycloak, but this is not enough to immediately authenticate into Coldfront. This issue prevents the bulk registration script from working, as it cannot access the information it needs on Coldfront.

We need to find a way to authenticate into Coldfront using these grants, or potentially look at other mechanisms of authentication.

[QuanMPhm]

@knikolla After reviewing all the Python code that might be relevant to this issue, I have a few ideas on how to solve this problem:

The main issue with our user registration script is that we are attempting to use the client credentials and device code flow, but the mozzilla_django_oidc plugin that coldfront uses only supports the authorization code flow. The reason the script could authenticate to api/allocations is because that endpoint uses a django_rest_framework view that has a unique integration with mozzilla_django_oidc. Ultimately, authentication flows besides authorization code won't work because the mozzilla_django_oidc plugin doesn't have built in code to allow authentication with just an access token.

This lead me to several possible next steps:

1. We could try finding a new Django OIDC plugin that supports the code flows we want, maybe Mokey, but I haven't looked into that.
2. We can continue to use the workaround @knikolla has in place, where we impersonate a Keycloak user to obtain their session cookies, and use that to pass the authorization code flow.
3. I can configure django_scim to use a special authentication middleware that would verify the OIDC access token and perform authentication only for the SCIM endpoints.

@knikolla I remember you have explained this to me before, but if we already have the workaround you showed us, why do we want to use the client credential or device code flows?

[knikolla]

@knikolla After reviewing all the Python code that might be relevant to this issue, I have a few ideas on how to solve this problem:

The main issue with our user registration script is that we are attempting to use the client credentials and device code flow, but the mozzilla_django_oidc plugin that coldfront uses only supports the authorization code flow. The reason the script could authenticate to api/allocations is because that endpoint uses a django_rest_framework view that has a unique integration with mozzilla_django_oidc. Ultimately, authentication flows besides authorization code won't work because the mozzilla_django_oidc plugin doesn't have built in code to allow authentication with just an access token.

This lead me to several possible next steps:

1. We could try finding a new Django OIDC plugin that supports the code flows we want, maybe Mokey, but I haven't looked into that.
2. We can continue to use the workaround @knikolla has in place, where we impersonate a Keycloak user to obtain their session cookies, and use that to pass the authorization code flow.
3. I can configure django_scim to use a special authentication middleware that would verify the OIDC access token and perform authentication only for the SCIM endpoints.

@knikolla I remember you have explained this to me before, but if we already have the workaround you showed us, why do we want to use the client credential or device code flows?

@QuanMPhm Can you try adding the Django Rest Framework variant of mozilla-django-oidc into the SCIM_SERVICE_PROVIDER config section first as described in the README? https://github.com/15five/django-scim2?tab=readme-ov-file#installation

It seems all these classes take a request and return a user and a token.

SCIM_SERVICE_PROVIDER = {
    'NETLOC': 'localhost',
    'AUTHENTICATION_SCHEMES': [
        {
            'type': 'mozilla_django_oidc.contrib.drf.OIDCAuthentication'
        },
    ],
}

[knikolla]

Ha, it seems that might be just metadata returned when querying provider information as I don't see that used.

[QuanMPhm]

@knikolla I was just about to say. This is the only place I saw that config variable being used.

[knikolla]

3. I can configure django_scim to use a special authentication middleware that would verify the OIDC access token and perform authentication only for the SCIM endpoints.

@QuanMPhm Try configuring a custom AUTH_CHECK_MIDDLEWARE that uses authenticate from mozilla_django_oidc.contrib.drf.OIDCAuthentication to validate the request.

@knikolla I remember you have explained this to me before, but if we already have the workaround you showed us, why do we want to use the client credential or device code flows?

Impersonation requires a Keycloak admin account. This would make it impossible for people to use their own accounts (which are not keycloak admins) which is why we implemented the device code flow. Similarly, the client credentials do not require an admin account, just the credentials to a client.

See: defense in depth, and principle of least privilege for more information about these practices.

EDIT: updated to mention that client credentials don't require keycloak admin either and to mention defense in depth and the principle of least privilege.

[knikolla]

@QuanMPhm Try to subclass SCIMAuthCheckMiddleware and change the process_response method here to something like this perhaps?

def process_request(self, request):
    if not hasattr(request, 'user'):
        user, _ = call to mozilla_django_oidc.contrib.drf.OIDCAuthentication.authenticate(request)
        if user:
            request.user = user

    super().process_request(request)

[joachimweyl]

@QuanMPhm have you had a chance to try what Kristi suggested?

[QuanMPhm]

@joachimweyl This issue is currently under review in #43. I have implemented all the feedback given so far

[knikolla]

Closed by #43