Making auth a first-class citizen

[batpad]

I think authentication is important enough a feature that ideally a user would just be able to add some options to their values to have it enabled and all working.

I'd imagine in values something like:

auth:
  enabled: true
  oidc_provider: https://example.com/.well_known/openid_configuration
  ... <optional additional config>

Or something equivalent, but that makes it that simple to add authentication. In my ideal world, once one has auth enabled, the STAC browser is also automatically configured to enable authentication.

Since stac-auth-proxy now publishes a helm chart, perhaps the best way to do this is to include it as an optional dependency?

I don't think this needs to be an immediate priority, but I think it would be nice to start a discussion and see if we all agree that we should work toward this at some point. I'd be happy to sketch this out further and contribute toward this if we feel like it makes sense to do - there could be things I'm missing which make it a better idea to just have it as a separate helm chart with documentation on how one can add it.

What do you think @emmanuelmathot @sunu @pantierra @j08lue @ividito @alukach ?

[sunu]

Yeah, I think making stac-auth-proxy an optional dependency is a great idea.

It improves discoverability and helps users see right away that authentication is supported and pluggable. I'm fully supportive of making eoapi-k8s as batteries-included as possible, especially for features like auth that many users will want out of the box.

We’d probably want to have it disabled by default, just to keep the base experience simple.

[alukach]

I'm fully supportive of making eoapi-k8s as batteries-included as possible

💯

We’d probably want to have it disabled by default, just to keep the base experience simple.

I think this also makes sense. You could run the proxy with DEFAULT_PUBLIC=true which would only protect the transactions endpoints, but the proxy expects a valid OIDC server's discovery endpoint to be provided, which may be difficult unless we can find some dummy stub OIDC server that exists.

---

Let me know if I can be of help in any way.