Bugfix/Authentication

[josvandervelde]

Use keycloak_openid.introspect(token) instead of keycloak_openid.userinfo(token).

The previous code used the bearer token to authenticate to Keycloak. In other words, it authenticated with Keycloak in the name of the user. (http://openid.net/specs/openid-connect-core-1_0.html#UserInfo) This meant that the client_id and client_secret were ignored. This is not directly unsafe, but it removes a layer of defense.

Instead, we want to authenticate as the AIoD API using the client_id and client_secret. We can do that using introspect: https://datatracker.ietf.org/doc/html/rfc7662.

Couple of other changes:

1. Made sure that a User object is returned, with only the username and roles. This way, we're sure not to leak any other information to our own application, and by extension to endpoints such as /authentication-test (just as precaution). Moreover, it simplifies the rest of the code, making authorization-checks less error-prone.
2. Checking the introspected information: is the user still active?
3. Added unittests

[jsmatias]

All good!
I just left a few comments and maybe add one more test to ensure no more information is returned about the user apart from username and roles.

Regarding this: "2. Checking the introspected information: is the user still active?
". How does the checking if the user is still active done? Is it implicitly done as part of the keycloak_openid.introspect() or is it implemented in the code more explicitly?

Other than that, all good! :)

[josvandervelde]

Regarding this: "2. Checking the introspected information: is the user still active? ". How does the checking if the user is still active done? Is it implicitly done as part of the keycloak_openid.introspect() or is it implemented in the code more explicitly?

This is done in authentication.py:

if not userinfo.get("active", False):
     logging.error("Invalid userinfo or inactive user.")
     raise RuntimeError("Invalid userinfo or inactive user.")  # caught below

[jsmatias]

I'm approving it.
Well done, nice job!