feat(admin): add optional basic auth to admin router #3097
Conversation
|
|
| @@ -6,6 +6,21 @@ describe('The Clients Admin Interface', function () { | |||
| grant_types: ['client_credentials'] | |||
| }) | |||
|
|
|||
| if (Cypress.env('admin_basic_auth')) { | |||
| it('should return a 403 error if basic auth credentials are not provided', function () { | |||
There was a problem hiding this comment.
| it('should return a 403 error if basic auth credentials are not provided', function () { | |
| it('should return a 401 error if basic auth credentials are not provided', function () { |
There was a problem hiding this comment.
Thank you for this PR and your hard work! Unfortunately, I don't think that we will merge this upstream. Having absolute freedom around how you protect the Admin API is one of the core design principles in Ory. By adding Basic Auth we introduce a pattern of access control which will need to be expanded very soon as use cases arise. For example, someone wants to have expiring and rotating secrets. Someone else wants permissions for clients, the next person mTLS, and so on.
To still improve the state of this we should instead add good documentation and examples (using e.g. Ory Oathkeeper) that explain how to easily protect the admin API of Ory Hydra.
In the future it would be great to create a design issue first to test the waters for larger features such as this one with core maintainers.
Thank you! :)
Add optional Basic Auth support for securing the Admin API.
Related issue(s)
hydraCLI client, intended for when running Admin API behind a reverse proxy: feat: basic auth support for hydra cli #3035Checklist
introduces a new feature.
contributing code guidelines.
vulnerability. If this pull request addresses a security. vulnerability, I
confirm that I got green light (please contact
[email protected]) from the maintainers to push
the changes.
works.
Further Comments
This was put together rather quickly, but seems to work nicely. We definitely didn't wrap our heads around Cypress properly for this, so chances are testing is not up to scratch, and we're happy to address any feedback.
Documentation update was also left out, as it looks like docs now live in their own repo.