Support Keycloak UMA flow internally

[daniel-pimenta-DME]

Title

Support Keycloak UMA flow internally

Summary

I noticed a Keycloak UMA section on documentation https://gogatekeeper.github.io/gatekeeper/userguide/#keycloak-authorization-uma, but is a bit limited from what i understood.
My request is for Gatekeeper to perform UMA flow internally (steps 1, 2, 3, 4 from https://gogatekeeper.github.io/gatekeeper/userguide/#keycloak-authorization-uma)

Why?

Would allow dynamic resource configuration and would leverage Keycloak UI to define resources and permissions.

How

Do steps 1, 2, 3, 4 internally when necessary.
Remove the forcing of --no-redirects since it's needed for sign-in authentication.

Acceptance criteria

Perform UMA flow without external code or requests being needed.

[p53]

Thanks for creating issue! Yeah i was thinking about UMA with redirects but i didn't know if anybody is using it so haven't implemented it yet, but now i know that somebody is using it :), will look at it, i need to find out good examples/docs for proper implementation.

[p53]

in the meantime gogatekeeper has integration with OPA (open policy agent) by which you can scalably manage authorizations with policies

[daniel-pimenta-DME]

Thank you :)
Some useful docs:
https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions

[daniel-pimenta-DME]

Seems to already support UMA flow when forwarding is enabled
https://github.com/gogatekeeper/gatekeeper/blob/master/pkg/keycloak/proxy/forwarding.go#L113

What we need is the following:

1. User accesses https://proxy/resource_url
2. Proxy performs authentication if needed
3. Proxy performs UMA flow on the resource_url, allowing access if no resource is defined
4. Proxy redirects to https://upstream/resource_url if access is allowed, redirects to the user with 403 if forbidden

Does that logic make sense?
Let me know if there's anything I can help with

[p53]

:) forwarding mode works a little bit differently compared to browser based scenario, we will need to set up cookies+think also about refreshing RPT token+right now RPT token is acquired for specific resource, what if you will already have access/refresh token but you will access different resource, you will need to get new RPT token, so it is not just steps you wrote, additionally i had to refactor a little bit code because i will need to add additional steps related to this UMA and it was already messy (original project code was quite messy...)

[daniel-pimenta-DME]

Yes true :D
What do you reckon is the best option to detect the need of a new RPT token when accessing a new resource?
That's the only issue i've noticed in your current PR
When i tried it, it seemed to use a uma_token cookie from a different resource, wrongfully returning 403

[p53]

still working on it ;)

[p53]

@daniel-pimenta-DME UMA code flow should be now finished, i tried to make it more simple, less configuration, compared what i saw for keycloak adapter docu, but it has some limitations. 1. per URL it matches only one resource in keycloak (so you must not have several resources with same URI under same client), 2. you should always have one permission per resource and right now gatekeeper can pass only one scope "method:" by which you access resource, enabled with --enable-uma-method-scope, 3. doesn't do claims gathering (this seems to be optional according to spec, spec isn't very detailed). You can try and let me know how it works/i can also help you e.g. on discord chat (link in main README)

[p53]

created 2.7.0-rc2 release=image

[daniel-pimenta-DME]

Thank you :)
I'll do some tests and let you know

1. per URL it matches only one resource in keycloak (so you must not have several resources with same URI under same client)

What would happen with one resource for /admin/* and another for /admin/1, and then try to access admin/1
Would it match the first or second resource?

[p53]

there is already 2.7.0 release/image, that would not work (it will be forbidden) because /admin/v1 path would match both resources, i understand that if you want to make exception this is easy way to do it but also could make things messy and error prone e.g. if i will have two matching resources which one should i choose?? probably some wise way would be more specific path, but then what about x-level nested resources, then evaluation time might be quite long+again error prone

[daniel-pimenta-DME]

Works well, thank you :D