Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

feat: Keycloak: Delegate user authentication to Keycloak (keep camera auth unchanged)

Abierto
  • ¿Algo no está bien?
#698 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
fastapi, postgresql, python
Área
api, authentication, backend, database

Línea de trabajo

Start with get_jwt, get_current_user, and TokenPayload, then trace POST /login/creds and the protected user routes. Done means user tokens are validated through Keycloak while camera tokens and /cameras/{id}/token remain unchanged, migration and client updates are covered, and the users table and obsolete login routes are removed.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Part of the epic pyronear/roadmap#23 (Keycloak).

Context & objective

We want to move user authentication to a Keycloak service (SSO, user management, password policies, MFA…).
This will be done in steps: this issue covers user authentication only. Camera authentication must keep working as is.

Follow-up: camera authentication via Keycloak (#699 ).

What is done currently

  • Users are stored in the users table (login, bcrypt password, role, organization_id). No other table references it.
  • Users log in via POST /login/creds and receive an API-signed JWT (JWT_SECRET, HS256).
  • Routes are protected by get_jwt / get_current_user, using scopes (admin, agent, user, camera) and organization_id from the token.
  • Camera tokens are issued separately via POST /cameras/{id}/token (same JWT mechanism, camera scope).
  • GET /login/validate isn't used by any client.

What has to be done

  • Validate Keycloak-issued tokens for user routes (realm JWKS) and map claims → TokenPayload (sub, roles → scopes, organization_id).
  • Move users to Keycloak: role and organization_id held there (roles / attribute or group).
  • Throwaway script for a one-shot manual migration of existing users.
  • Remove the users table, /users routes, /login/creds and /login/validate.
  • Keep API-issued camera tokens (/cameras/{id}/token) working, with no change on devices.
  • Update clients currently using /login/creds: new-pyro-platform, pyro-envdev init scripts, pyro-annotator ingestion client (→ Keycloak service account).

Technical considerations

  • During this step the API receives two kinds of tokens: Keycloak-signed (users, verified with the realm public keys) and API-signed (cameras, verified with JWT_SECRET). Read the token's iss claim to pick the right verification.
  • TokenPayload.sub is typed int, but a Keycloak user sub is a UUID string. Allow both, or split user and camera payloads (for cameras, sub is still used as camera_id, e.g. in poses.py).
  • User management (create, roles, org) is done in Keycloak from now on.
  • Dev & e2e: rely on the Keycloak service in pyro-envdev (pyronear/pyro-envdev#45). Keycloak deployment on prod is out of scope.
  • Keep the issuer dispatch simple and isolated, so that the API-issued path can be dropped once cameras are migrated.
Lenguaje dominante
Python
Estrellas
30
Forks
14
Merge medio
3 d 18 h
PR fusionados (30 d)
13

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de pyronear/pyro-api

Todos los issues de pyronear/pyro-api

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.