Authentication notes

In the developement of the authentication we tested with Keycloak, in Keycloak it is required to flatten the roles for the authentication to be able to pick up the roles.

I recommend changing your main admin console theme too "keycloak" theme before following these instructions, this can be done by going to

select Master realm -> Realm Settings -> Themes -> Admin Console Theme -> "keycloak" -> refresh page & change back to your app realm

Now to create mapper to flatten the roles

Clients -> Mappers -> Create

Back on the client page navigate to roles tab and add a role (for example "monai-role-user")

Then in users -> roles mappings

select Client Roles, in the dropdown select your client from the list and should see in avaliable roles role your created above and move that into assigned roles.

This is an example of MonaiDeployAuthentication configuration:

  "MonaiDeployAuthentication": {
    "BypassAuthentication": false,
    "openId": {
      "realm": "http://localhost:8080/realms/monai-test-realm",
      "realmKey": "realmKey",
      "clientId": "monai-service",
      "audiences": [ "monai-deploy", "account" ],
      "claimMappings": {
        "userClaims": [
          {
            "claimType": "user_roles",
            "claimValues": [ "monai-role-user" ],
            "endpoints": [ "payloads", "workflows", "workflowinstances", "tasks" ]
          }
        ],
        "adminClaims": [
          {
            "claimType": "user_roles",
            "claimValues": [ "monai-role-admin" ],
            "endpoints": [ "all" ]
          }
        ]
      }
    }
  },

realmKey can be found in Clients -> Credentials -> Secret

and bare minimum for bypass is...

  "MonaiDeployAuthentication": {
    "BypassAuthentication": false,
  }

• realm: link to you OpenId provider

• realmKey: OpenId provider key

• clientId: name of you client in the client in openid provider

there are 2 types of claims

userClaims

adminClaims

example here we use:

"claimType": "user_roles",
"claimValues": [ "monai-role-user" ],
"endpoints": [ "payloads", "workflows", "workflowinstances", "tasks" ],

claimType user_roles maps back to setting above (JWT) Token Claim Name.

claimValues monai-role-user is role we have setup and expect to find for users.

endspoints is a list of endpoints that authorised to access comma seperated string.

expected values: (values can be upper lower or normal casing):

• all,
• payload,
• workflows,
• workflowinstances,
• tasks