Authentication on workspace agent

[skabashnyuk]

The main difference between wsmaster and wsagent authentification is that wsagent is a completely untrusted environment. We can't store any system-wide secrets here. We have such options.

• Reuse machine token authentication from Codenvy
• Dynamically register new OpenId clients for each workspace and grant access to only for a particular set of users who have permissions to use it.

[mshaposhnik]

So we investigated a few ways to make agent authentication; Still not have strong opinion which one is better to choose.

1. Pure Keycloak auth with shared token between master and agents - simplest way, easiest to implement, but not secure enought - it's easy to retrieve token on another's WS and do bad things on master with it.

2. Use machine authentication from Codenvy on agents - so agents are totally uncoupled from Keycloak auth, use their own tokens to access master and agent API. This way has a higher complexity to implement, need to manage at least two (or more) tokens for each user on master, and choose them depending on where the request goes, probably even use two different request factories. This way also depends on permissions, so they are must be adapted in some form from Codenvy also.

3. Pure Keycloak auth with separate Keykloak token for master and agent. This is the way which RH guys seems to be tried on theis side, AFAIK without success yet. We haven't tried it for this moment of time. It has also some complexity (i.e. obtaining the token duing agent startup to be able to make requests to me master during that, using different public and private realms e.t.c) but looks pretty logical for me personally.

[garagatyi]

I think in #3 it should be a token for the whole workspace, not just 1 agent. WDYT?

[mshaposhnik]

More about 2 - it is possible situation, when requests came from agent to the master having machine token only, and not possible to do any keycloak actions like roles validating e.t.c. Also it is requires huge overhead transforming KC tokens into machine tokens on requests to agents, skipping machine tokens in filter, etc

[mshaposhnik]

Done using machine auth;