Apicurio registry security - basic auth support

Hi There

Another question related to security with Apicurio 2.0.1.Final. Our ecosystem will contain applications using different client serializer libs (confluent, apicurio, …).

What our main goals are:

• Read access: Must be compatible with most client libraries (confluent, apicurio, …).
• Write access: Should be secured (e.g. RBAC like apicurio registry provides with oauth sr-admin, sr-developer)

For read access:

• e.g. confluent libs do not allow to configure oauth. which leads us to leave read access either unprotected or basic auth
• As far as i know apicurio registry does not support to use keycloak and http basic auth at the same time.

Question:

• Documentation “Configuring your Apicurio Registry deployment” only mentions OAuth with Keycloak. Is using Apicurio Registry with Basic Auth possible?
• Is it possible to use OAuth or Basic Auth for admin and developer purpose but leave read access unprotected?
• Are the quarkus.http.auth.permission.* overridable? e.g. removing the read-apis from the quarkus.http.auth.permission.sr-read.paths and add them to the quarkus.http.auth.permission.permit1.paths?

[EricWittmann]

We are in the process of testing using a non-Keycloak solution for auth (e.g. Auth0) but don’t have results on that yet. The goal is hopefully to support any OpenID Connect solution. But it’s unclear how easy that will be. 😃

[carlesarnal]

Not really, that can be achieved using a custom build but it’s not supported out of the box.