RFC: Sofie Authentication about sofie-core HOT 2 OPEN

Stable API & Users/Operators

I guess technically, what we would want is OpenID Connect since that would provide us with an "ID Token" JWT containing user profile information. Microsoft produces the "ID token" with a claim of "roles", okta returns a claim of "groups", both seem to be an array of strings. I suppose we could make which claim to use configurable.

I'm not sure if there's a standardized way of providing a list of other installations that the user can access through SSO. I suppose this could be done inside the ID Token as well, as a custom claim. It seems that at least Azure's Active Directory OpenID Connect implementation allows adding custom claims to the ID Token.

Persistent views

I suppose the "Persistent views" could use some sort of a URL search parameter secret. We would then have to ensure that they would have a "read-only" access then, since sniffing that search parameter would be trivial. This would basically allow one to have the Sofie without unauthorized people "peeking at it", but still be able to persist those secrets somewhere so that, for example, the Studio baseline can start renderers of these views out on SDI.

from sofie-core.

For users, the authentication side of this could be simplified by listening to certain headers from trusted proxies. The loadbalancer (eg nginx) can then be setup to do the authentication with whatever backend is needed, and populate the headers for us. A big benefit of this approach is that this is a common structure used in kubernetes, so for any organisation wanting to deploy to kubernetes this will work for free.

Perhaps this could be the only authentication method we support?
For other views/uses which want more persistent authentication methods, that becomes a matter of coordinating that with the loadbalancer doing the authentication. It would be possible to configure it to support multiple authentication methods, such as certificates of long-lived tokens. For these it will just be a matter of ensuring the client is capable of the chosen methods.

from sofie-core.