Basic Authentication :How to create a user?

[jthak002]

Hello,
How is the user for basic authentication created on the Schema Registry? I am trying to set up a single node schema registry with PostgreSQL, and how do I create the user? I looked in the documentation, and I set the CLIENT_CREDENTIALS_BASIC_AUTH_ENABLED, ROLE_BASED_AUTHZ_ENABLED, and ROLE_BASED_AUTHZ_SOURCE to true, true and application respectively. In the REST API reference, I only see the admin/roleMappings API that is used for mapping the roles to a user from 1 of the 3 built-in roles.
Am I missing something? Is the user-created from the Authorization header when the first request to create an artifact is received?

[EricWittmann]

The only way to enable authentication/authorization in registry is by configuring it to work with an instance of Keycloak.

https://www.keycloak.org/

This documentation should probably help:

https://www.apicur.io/registry/docs/apicurio-registry/2.1.x/getting-started/assembly-configuring-the-registry.html#registry-security_registry

But you will need both applications running. Registry does not currently support authn/z without Keycloak.

Once set up, Keycloak is then where the users are configured.

[githubing]

hi Eric, yes I would need some clarification if possible.

1. when you say 'by storing the role mapping in the registry database', does it mean that it will use the local SQL database? I use Kafka as storage and I think that local SQL is ephemeral as all the persistent data is always kept in the Kafka topic. So my question is, does it mean that also the mappings will be stored in that topic?
2. Other than Carles (that I hope he can give some advice), is there any documentation to read? I would need to know what kind of authentication server I can use, how to configure it, etc etc. I will definitely be interested to hear more :)
   thanks!

[EricWittmann]

1. If you are using the kafkasql storage variant, then the role mappings will be stored in the Kafka topic.
2. Support for auth systems other than Keycloak is quite new and I don't think currently documented. Hopefully we'll have something soon.

[carlesarnal]

Hey @githubing, not, there is no documentation yet for this since it's not even present in a release (just merged into master). Any OIDC server like Auth0 or obviously Keycloak should work, basically servers capable of issuing tokens compliant with OpenID Connect and OAuth 2.0. Related to roles, if you want to use a server different from Keycloak, I recommend you to store the roles in Registry (in your particular case, as Eric pointed out, they will be persisted in the Kafka topic), since I never tested using other servers for authorization purposes, just for authentication.

[XxXantivirusXxX]

Hi @EricWittmann @carlesarnal.
Do you have any updates regarding this topic? It would be nice to have documented examples of integration with most popular auth options(without Keyclock, I've interested in AWS cognito)
One more question. Is it possible to configure role mappings inside of application using config file and define path to this file? I found only option do it using api https://access.redhat.com/webassets/avalon/d/Red_Hat_build_of_Apicurio_Registry-2.3-Installing_and_deploying_Apicurio_Registry_on_OpenShift-en-US/files/registry-rest-api.htm#tag/Admin/operation/updateRoleMapping
Thanks

[carlesarnal]

There are no updates other than what I shared. It would be sure nice to have those examples, but we just don't have the time to write them (if you want to contribute, that would be awesome). About the question of the roles, unfortunately, no, there are two possible sources for the role, the identity server itself (where the role resides in) and the application database but using the properties is not supported.