Authentication for API endpoints about cerbos

[emreb]

Should we be thinking about this separately for load and check end points?

Does basic authentication mean, just an http header? Perhaps we then need to give them a way of setting that in the config as well as in the support libraries.

If we are going to bake it into the support libraries perhaps we should just do JWT (and not the simplistic basic auth).

Client certificates is definitely premium feature.

Thoughts?

[charithe]

Basic auth is the easiest way to get started and almost all HTTP libraries have support for it. It does involve setting a header, but, so does JWT. It's basically just sending a hashed username and a password in a header. It's not much work to support basic auth on our side and I think that can be a good starting point for many users who want to just try it out.

JWT is a bit more involved because they need to have a central signing server and distribute keys to applications. I don't think many small shops will have that infrastructure in place for their internal services (unless they are using something like Auth0 internally as well).

[emreb]

Agreed. Good plan to start off with basic authentication.

…

On Sun, Mar 7, 2021 at 10:32 AM Charith Ellawala ***@***.***> wrote: Basic auth is the easiest way to get started and almost all HTTP libraries have support for it. It does involve setting a header, but, so does JWT. It's basically just sending a hashed username and a password in a header. It's not much work to support basic auth on our side and I think that can be a good starting point for many users who want to just try it out. JWT is a bit more involved because they need to have a central signing server and distribute keys to applications. I don't think many small shops will have that infrastructure in place for their internal services (unless they are using something like Auth0 internally as well). — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://github.com/emreb/paams/issues/23#issuecomment-792253830>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABMF6AQ3MORZPPE23A4Q5LTCNI4DANCNFSM4YW5IOOQ> .

[emreb]

Is this still open? Docs says you can add certs.

[charithe]

Yes. This task is about adding basic auth, JWT etc.