Single Sign On (SSO)

[mmguero]

@mmguero cloned issue idaholab/Malcolm#297 on 2023-11-21:

Malcolm currently supports two authentication modes:

• basic auth
• LDAP/Active Directory

Both of these are done through NGINX so that it can be authenticated in one place for all of Malcolm (rather than in individual components like Arkime, Dashboards, etc., which would otherwise all have their own authentication).

We should look into adding SSO as a third method, based on whatever NGINX could support for that via plugins or whatever.

[mmguero]

@mmguero commented on 2024-02-21:

A few possible resources

• Luzifer/nginx-sso

• Configure NGINX and Keycloak to enable SSO for proxied applications

[mmguero]

@mmguero commented on 2024-09-04:

A comment from a Mal.Con24 attendee:

AuthN support for Authentik would be great.

[mmguero]

@TheFutonEng is doing some experimentation with nginx/keycloak here that we might be able to draw lessons from.

[mmguero]

See proxy-based authentication in the opensearch documentation for relevant information.