Authentication configurations

Authentication

By default actinia uses basic authentication, but you can also disable authentication in the configuration file for the whole actinia API or use OAuth2 e.g. to connect to Keycloak.

Basic authentication

By default actinia uses basic authentication. The version and swagger documentation can be requested without authentication:

curl ${ACTINIA_BASE_URL}/api/v3/version
curl ${ACTINIA_BASE_URL}/api/v3/swagger.json

Most other endpoints require a username and password. For example:

curl -u "user:password" ${ACTINIA_BASE_URL}/api/v3/locations

Disable authentication

Authentication can be disabled for the entire API by setting authentication to False in the API section of the actinia configuration file:

[API]
authentication = False

After disabling authentication, endpoints can be accessed without credentials:

curl ${ACTINIA_BASE_URL}/api/v3/locations

OAuth2 / Keycloak configuration

Actinia can also verify the Keycloak token. For this a KEYCLOAK section has to be added to the actinia configuration file:

[KEYCLOAK]
config_path = /etc/default/keycloak.json
group_prefix = /actinia-user/

The config_path must point to the Keycloak OpenID Connect JSON configuration file for the actinia client.

To access the API with a Keycloak token:

TOKEN=xxx
curl -H 'Accept: application/json' -H "Authorization: Bearer ${TOKEN}" ${ACTINIA_BASE_URL}/api/v3/locations | jq

For an example development setup, see the local Keycloak setup for actinia-core.

Related documentation

• Deployment guide
• Job queues and workers
• FAQ