How CyVerse authenticates users¶

CyVerse authenticates through Keycloak, which brokers to CILogon for federated institutional identity and to OAuth 2.0 providers such as Google, GitHub, and ORCID.

sequenceDiagram
  autonumber
  User->>Browser: Click on external Auth
  Browser-->>Keycloak: Authentication request (TOKEN)
  loop
      Keycloak-->>Browser: Browser opened with ../auth?=client_id=de-prod=TOKEN
  end
  Keycloak-->>CILogon: Auth Request
  User->>CILogon: Enter Credentials
  Keycloak-->>OAUTH: Auth Response
  CILogon-->>Keycloak: Auth Response
  Browser-->>OAUTH: Ask for Token
  OAUTH-->>Browser: Retrieve Token

Users start at the left: the browser is redirected to Keycloak, which brokers the request to CILogon or an OAuth provider, and the token comes back through the browser.

The public US deployment runs Keycloak at kc.cyverse.org.

Deployment¶

Keycloak runs in the Kubernetes cluster, in its own namespace. Deploying and configuring it — realm, LDAP federation, mappers, realm roles, and the OAuth clients each CyVerse application needs — is covered in Keycloak deployment. Its database is the Keycloak database, and the account directory it federates is OpenLDAP.

Using it from an API client¶

Terrain accepts OAuth and OIDC tokens issued by Keycloak; see Terrain for how clients obtain one.

The provisioning playbooks live in ansible-kubernetes-keycloak.

How CyVerse authenticates users¶

Deployment¶

Using it from an API client¶

Related¶