We currently have some automation use cases which are not using FAS (or any other auth, in some cases) where I think they could be. This is primarily around how we publish things outside of Fedora Infra proper. I don’t want to name the specific use cases here because I believe they might represent risks, but I’d like to discuss in the abstract what I believe to be the correct solution for automation use cases.
OAuth 2.0 Device Authorization Grant ( RFC 8628 ) is essentially, “A human logs into FAS once via standard methods and then receives a refresh token whose TTL can be refreshed indefinitely.” If the token expires because the user didn’t refresh it fast enough, they can always manually log in again for a new refresh token. This allows us to put FAS in front of any OIDC-capable service (including apache / haproxy) while still allowing people to easily self-serve their automation needs.
The alternative option is Client Credentials Flow, where an admin has to get involved to provision each client + client secret. Presumably we want to avoid the admin toil + long-lived secrets of this approach, but it is a valid one.
Is there any plan to support automation with FAS auth? Have we discussed this in the past / do we have any thoughts around creating a plan here? (One which I might be able to help implement?)
I’d like to get this in place before proposing adding FAS auth to specific endpoints, so that if/when we enact that we already have a replacement solution for existing unauthenticated automation.
I’m aware that we do have Kerberos auth in some places, but since most modern auth solutions are OIDC / OAuth by default and Kerberos support is dwindling, I think it would be worth considering how to move forward with this as a user-friendly approach for securing any endpoints which are currently open.