Authentication and Authorization

Motivation

HelixML relies on robust security protocols, including authentication and authorization, to protect sensitive data and ensure authorized access to resources. Keycloak, an open-source identity and access management solution, is employed to implement these features within HelixML.

Authentication

Authentication verifies the identity of users attempting to access HelixML. Keycloak provides a range of authentication options:

• Username/Password: This is the most common method, where users provide their credentials (username and password) to authenticate. [https://www.keycloak.org/docs/latest/server_admin/index.html#_username_password_form]
• Social Login: Users can authenticate using existing accounts from providers like Google, Facebook, or Twitter. [https://www.keycloak.org/docs/latest/server_admin/index.html#_social_login]
• SAML: Security Assertion Markup Language (SAML) allows single sign-on (SSO) with other applications and identity providers. [https://www.keycloak.org/docs/latest/server_admin/index.html#_saml]
• OpenID Connect: A modern authentication protocol built on top of OAuth 2.0 for identity and access management. [https://www.keycloak.org/docs/latest/server_admin/index.html#_openid_connect]

Authorization

Authorization determines what resources a user can access after authentication. Keycloak provides a flexible authorization system based on roles and permissions:

• Roles: Groups of users with shared permissions. Users can be assigned to multiple roles, enabling fine-grained access control. [https://www.keycloak.org/docs/latest/server_admin/index.html#_roles]
• Permissions: Specific actions a user can perform on a resource. Permissions can be attached to roles for convenient access control. [https://www.keycloak.org/docs/latest/server_admin/index.html#_permissions]

Keycloak Integration

HelixML integrates with Keycloak to manage authentication and authorization. This integration involves:

• Keycloak Server: A dedicated Keycloak server configured to handle user authentication and authorization for HelixML.
• Keycloak Client: A HelixML application registered with Keycloak, which handles communication with the Keycloak server.
• User Authentication: When users attempt to access HelixML, they are redirected to the Keycloak server for authentication.
• Authorization Enforcement: HelixML enforces authorization rules defined in Keycloak by using the Keycloak client to verify user permissions.

Examples

User Authentication

1. A user navigates to the HelixML website.
2. The website redirects the user to the Keycloak server for authentication.
3. The user enters their username and password.
4. Keycloak verifies the credentials and, if valid, issues a token containing user information.
5. The user is redirected back to the HelixML website with the authentication token.
6. The HelixML application verifies the token and grants access to the user.

Resource Authorization

1. A user, authenticated via Keycloak, attempts to access a protected resource (e.g., a dataset).
2. HelixML uses the Keycloak client to check the user’s assigned roles and permissions.
3. If the user has the necessary permissions to access the resource, access is granted.
4. If not, access is denied, and an appropriate error message is displayed.

Source Code

The integration between HelixML and Keycloak is implemented in the auth.py file. This file handles communication with the Keycloak server, user authentication, and authorization enforcement.

# auth.py
          from keycloak import KeycloakOpenID
          
          # Configure Keycloak client
          keycloak = KeycloakOpenID(
              server_url='http://localhost:8080',
              client_id='helixml',
              realm_name='helixml',
              client_secret='your_secret'
          )
          
          # Authenticate user
          def authenticate_user(username, password):
              # ... (implementation using keycloak.login())
          
          # Authorize user
          def authorize_user(resource, user_roles):
              # ... (implementation using keycloak.validate_token())
          

This file provides a foundation for managing user authentication and authorization in HelixML, leveraging the functionalities offered by Keycloak.