Ability to implement custom Auth handlers
hakan-77 opened this issue · comments
Is your feature request related to a problem? Please describe.
Implementing a real-life solution with basic authentication is simply not acceptable for many organizations.
Describe the solution you'd like
Although an SSO/OAuth2 style solution would be nice, a simpler way to provide hooks to outside world to authenticate would be enough to get started for simple applications.
Describe alternatives you've considered
A simple alternative to SSO would be a JWT based solution.
Admin could define 3 new env variables and Kasm VNC could validate the user by using the jwt token. Admin would be responsible authenticating via a login page etc., generate a jwt token using the private key, and then adding the resulting jwt to the query string. (jwt access tokens are short lived by nature)
Details:
1/ Developer would add the jwt public key to an env variable.
2/ Developer would also add the "key" and "value" to look for in the jwt token. e.g. can_use_kasm_vnc = true
3/ A request comes to Kasm VNC, auth would work this way:
a/ Is jwt valid? By checking the public key in an env variable, Kasm can tell if the token is legit. (generated via the correct priavate key)
b/ Has the jwt token expired? (standard jwt stuff)
c/ Can the user login to this kasm vnc? = is the key (e.g. can_use_kasm) in the payload & is the value (e.g. true) correct.
Optional: After authenticating, Kasm VNC could also redirect the address without the token query string (e.g. access-token=..) so the final URL looks cleaner. jwt tokens are long.
If you are interested I can help with the security elements for this solution.
JWT is definitely of interest to us. I don't have a timeline right now though. If you are interested in submitting a PR to add JWT support, let me know and I can provide a better description of how it should be implemented, that will help ensure it gets merged in quicker order.