feat(auth-jwt), fix|docs(charts): Security Assessment #27
Conversation
… useful default authentication configuration of the data/agent plane's default endpoint that is targetted towards applications.
… explanation of the redirection filter expressions in the agent plane configuration.
There was a problem hiding this comment.
Sorry, but I am a bit overwhelmed - in a positive way.
This is a lot of code. My Spring Boot is a bit rusty :)
values.yaml(s) look good.
I also checked the JwtAuthenticationService, because it says "auth-jwt" for default in the issue (maybe I am wrong). Looks also good.
By default, the auth type is set to "api-key", is this intentional? While this approach may be simpler, it could also be riskier.
|
Thx much for caring and the good hint:
We started with the idea of having JWT as the "natural" way to secure an application-facing endpoint of the EDC for enterprises. And found out that maybe a stack of composable authentication services would be a great addition to EDC. However, this would always have an external dependency on an IDP (or at least its public key). Due to the need to ship a chart which can be installed on a fingertip, we choose to extend/switch to the api-key approach in the default config (and document and even foster the switch to jwt in the documentation). So the modules focus is more on auth-compose, amybe we should rename it in the next release. |
|
Got it. Thanks for clarifying |
WHAT
Provides a useful default authentication configuration (based on api-key hashes) which can be easily adopted, e.g. to use jwt-based authentication.
WHY
Security Assessment Threat Mitigation
FURTHER NOTES
Currently, we need to copy the EDC charts, because the helm value/template structure is significantly changed by introducing multiple dataplanes (of which the agent plane is one option). A reference to the original chart has been added right into the documentation.
The chartlint workflow already looks like the final upgrade workflow, but since the EDC charts are always depending on some external service (hashicorp, azure-vault), we cannot easily deploy (and hence upgrade-test) the charts.
Closes #24
Explains but not closes #26