Delegate authentication to reverse proxy with REMOTE_USER header

[abretaud]

Hi,

Context: with @hexylena, we've been setting up/maintaining a public apollo2 instance (https://usegalaxy.eu/apollo/), connected to https://usegalaxy.eu. I'm interested in migrating this instance to Apollo3 in the future, so I'm currently investigating how we could do this migration.

The first obstacle I'm seeing is that Apollo3 seems to only support google or microsoft authentication. Do you plan on implementing other methods?

We've been relying on a pretty standard mechanism: a REMOTE_USER header set by a reverse proxy. In our case it would be https://github.com/hexylena/gx-cookie-proxy, but it would work with any method provided by the reverse proxy, including connecting to a LDAP or more complex setup like Authelia, Keycloak etc.

Do you think it would be possible to support this mechanism in Apollo3? It would make the migration much easier for this usegalaxy.eu/apollo/ instance, as well as for other local instances connected to LDAP servers

[hexylena]

agreed, big fan of remote_user, it opens up a lot of useful deployment options. happy to share any documentation y'all'd find helpful

[garrettjstevens]

@abretaud and @hexylena, thanks for bringing this up. Authentication is something I've been wanting to make more flexible in Apollo 3. Originally this meant being able to configure any OAuth2 provider instead of just Google and Microsoft, but seeing your system has given me some ideas of how we might make it even more flexible without adding too much complexity. I'm still doing some brainstorming of how this might fit together, but it would probably involve allowing an Apollo plugin (which is just a JBrowse plugin with some Apollo-specific info) to configure some authorization info. I'll share a more concrete idea of what that would look like when I get it worked out, but I'll let you know if I have questions for you in the meantime.

[garrettjstevens]

Ok @abretaud and @hexylena, first question, what happens if the request from the client doesn't have a Galaxy cookie? I'm trying to figure out if I need to account for some sort of login redirect.

[hexylena]

Hi @garrettjstevens that's the best part, not something you have to handle! If REMOTE_USER isn't set (and it is enabled as the auth source), then you just deny access. You don't have to worry about any of the implementation details. Either you get a remote_user header and you trust that identity (usually an email), or you don't, and you return 401 unauthorized.

In practice, for services that implement remote_user, requests basically never hit the backend without the remote_user header, the proxy sees that the user is unauthenticated and handles that either by doing a redirect or, whatever login method is required.

The header itself is usually REMOTE_USER, it's 'protected' by essentially all reasonable proxies, they won't let a client set that header, it has to come from the proxy itself, it's never forwarded in a request.

[hexylena]

The apollo2 implementation: https://github.com/GMOD/Apollo/blob/ff317530425c6e3f507d37e8fa708d4911d86d7b/grails-app/services/org/bbop/apollo/authenticator/RemoteUserAuthenticatorService.groovy#L43 you just create the account for them, if it's an email you haven't seen before.

[abretaud]

Hi @garrettjstevens ! By chance, have you made any progress on this issue, or do you have plans for it in the near future? I'm asking because I'm trying to organize myself for a project that would require it in the coming months

[garrettjstevens]

Hi @abretaud I do plan on working on this soon. I spent a bit of time recently planning out the development and I think it's pretty reasonable.

[garrettjstevens]

I've started work on this in #758. To use it, you would create a JBrowse plugin with something like the following, and add that plugin to Apollo. More info/docs to come in that PR, but hopefully this gives you an idea of whether this would be sufficient.

pluginManager.addToExtensionPoint(
  'Apollo-RegisterCustomAuth',
  (
    customAuths: Map<
      string,
      {
        message: string
        needsPopup: boolean
        handler: (
          request: Request,
        ) => Promise<{ name: string; email: string }>
      }
    >,
  ) => {
    customAuths.set('galaxy', {
      message: 'Sign in with Galaxy',
      needsPopup: false,
      handler: async (request: Request) => {
        const remoteUser = request.headers.REMOTE_USER
        if (!remoteUser || Array.isArray(remoteUser)) {
          throw new Error('Invalid remote user')
        }
        // Look up name here, otherwise just use email for both
        return { name: remoteUser, email: remoteUser }
      },
    })
    return customAuths
  },
)