Implement SSO (Epic)

[jhmarina]

Description

As s3gw is deployed in the field, we must consider users will find the need to maintain the same set of credentials for multiple s3gw instances, may they be in the same cluster or, potentially, across clusters.

It becomes a chore to maintain multiple s3gw instances' credentials in sync.

Supporting Single Sign-On would enable users of s3gw to manage their credentials centrally, and having the various s3gw UI's all relying on the same authority.

Similarly, by supporting STS (#229) we could potentially issue temporary tokens for direct access to an s3gw instance.

We should consider that this topic needs further research to understand how this can be implemented, or stitched together with existing solutions.

For reference, RGW already supports some IAM solutions:

• Keycloak (website, rgw docs)
• LDAP (rgw docs)
• Openstack Keystone (website, rgw docs)

Success criteria

• Users are able to login into multiple s3gw UI instances sharing the same centralized credentials
• Users are able to obtain STS temporary credentials to access multiple s3gw instances for S3 operations
• The effort has been properly tested
• There is appropriate documentation

More information

### Tasks