Activity

1. clouserw

   added

   feature request

   on Aug 28, 2019
2. clouserw

   added this to the Product Ideas 💭 milestone on Aug 28, 2019
3. rfk commented on Sep 10, 2019

   

   rfk

   on Sep 10, 2019

   More actions

   Is it possible to use something like Keycloak (via OAuth 2.0?) instead of a FXA server
   for user logins of Mozilla Send?

   Send uses a fairly unique feature of FxA whereby the signin flow generates client-side encryption keys that the application can use to protect data stored on the server. Any replacement auth system would need to provide similar functionality.

   Can we use the one from Mozilla and - if yes - how can we obtain a client id?

   Sorry, we do not yet allow third-party services to use FxA as an OAuth provider. I'd like to see us allow it one day but it's not on the short-term roadmap.
4. immanuelfodor commented on Jan 1, 2020

   

   immanuelfodor

   on Jan 1, 2020

   More actions

   Send uses a fairly unique feature of FxA whereby the signin flow generates client-side encryption keys that the application can use to protect data stored on the server. Any replacement auth system would need to provide similar functionality.

   Hmm, wait, what? The FxA server generates the client-side encryption keys?

   As FxA is used for e.g. Firefox Sync, this effectively means the server knows how to decrypt the data stored in a self-hosted sync server?
5. immanuelfodor commented on Jan 1, 2020

   

   immanuelfodor

   on Jan 1, 2020

   More actions

   If an FXA server is required: Can we use the one from Mozilla and - if yes - how can we obtain a client id?

   There is an open issue how to self-host the FxA server, you can follow it here: mozilla/fxa#3652 One day you might be able to host your own instance, so you'll be able to obtain yourself a client ID.
6. rfk commented on Jan 2, 2020

   

   rfk

   on Jan 2, 2020

   More actions

   Hmm, wait, what? The FxA server generates the client-side encryption keys?

   Not quite; the FxA login protocol is designed to generate a client-side encryption key without revealing it to the server, you can read a bit about it in this blog post.
7. immanuelfodor commented on Jan 3, 2020

   

   immanuelfodor

   on Jan 3, 2020

   More actions

   Oh, I see the separation now, thanks for the link. Now, I get why a simple Oauth provider can't replace the FxA server easily.
8. neo-inuit commented on Feb 3, 2020

   

   neo-inuit

   on Feb 3, 2020

   More actions

   For information i do use the mod_auth_openidc with apache in front reverse proxy

   protect server behind apache2 avec openid

   Doc : https://github.com/zmartzone/mod_auth_openidc

   install

   apt-get install apache2
   apt-get install libapache2-mod-auth-openidc

   config apache

   a2enmod headers rewrite proxy_wstunnel proxy_http proxy auth_openidc

   configure keycloak

   https://github.com/zmartzone/mod_auth_openidc/wiki/Keycloak

   I just change the apache regexp to allow download but not upload, the regexp is not perfect

   <Location ~ "^((?!/download|/api|\.css|.\.js|\.svg|\.woff2|\.png).)*$">
           # desired configurations
              AuthType openid-connect
              Require valid-user
           </Location>