AuthN and AuthZ with PSI

[pozsa]

We want to use a publicly available auth option from PSI.

[pozsa]

the usual way to hook up external applications to PSI authentication is through SWITCHaai and adding psi.ch DNS entries happens through the ICT networks team.

SWITCHaai supports SAML2. At the moment the service managers at PSI are responsible for managing their SP’s. At the moment there is no such thing as a central support for SAML2 SP’s.

[pozsa]

We are going to use a keycloak instance as an auth server that is hooked up to PSI saml.
The public frontend will use PKCE to get an access token from the auth server. The backend will get the JWK set from the auth server and decode the access token to check validity.
This will cover our authn needs.

We'll discuss authz requirements a bit later.