pygeoapi-auth

authentication and authorization for pygeoapi

Youssef Harby

https://github.com/cartologic/pygeoapi-auth-deployment

docker run --rm -p 5000:80 geopython/pygeoapi:latest

Host

Container

http://localhost:5000

But what if I have sensitive data?

We need to protect it !

Host

Container

Or any reverse proxy

Port : 80

Port: 443

Port : 80

Port: 443

Host

But what about authorization !

Can access any collection/item

Now I know you

The Solution!

forward authentication

Architecture Diagram if HTTP 200 OK

Port : 80

Port : 9001

Port: 80

Port: 443

Port: 80

Port: 443

Host

User: yharby

app.pygeoapi.local/api/collections/obs

pygeoapi.local/?rd=https://app.pygeoapi.local/api/collections/obs&rm=GET

pygeoapi.local

app.pygeoapi.local

1

2

3

HTTP 200 OK

4

5

Response

6

Response

Redirected to authelia with redirect needed endpoint in query params

Isolated Docker Network

Architecture Diagram HTTP 4xx KO

Port : 80

Port : 9001

Port: 80

Port: 443

Port: 80

Port: 443

Host

app.pygeoapi.local/api/collections/obs

pygeoapi.local/?rd=https://app.pygeoapi.local/api/collections/obs&rm=GET

pygeoapi.local

1

2

3

HTTP 4xx KO

4

ERROR

Redirected to authelia with redirect needed endpoint in query params

Isolated Docker Network

User: francbartoli

Todo list:

• Enable OpenID Connect (https://www.authelia.com/integration/openid-connect/introduction/).
• External user authentication (LDAP/Keycloak..etc).
• Test against QGIS and other GIS desktop applications.

Q&A