Enable Basic authentication

[daniel-pimenta-DME]

Summary

Enable Basic authentication.

Why?

I have a Gateekeper working well with Authorization Code Flow (using access tokens) but would like to also accept Password Credentials Grant (basic auth with user and password)

How

Not sure if this is already supported, but maybe a configuration flag to enable it.

Additional Information

My configuration

client-id: ...
discovery-url: https://keycloak/realms/master
no-redirects: true
no-proxy: true
enable-uma: true
enable-metrics: true
enable-logging: true
enable-request-id: true
enable-login-handler: true
enable-refresh-tokens: true
enable-logout-redirect: true
listen: :3000
listen-admin: :4000

Gatekeeper is used with nginx ingress, which then redirects to the upstream application if auth_request response is 200:

nginx.ingress.kubernetes.io/configuration-snippet: |
  auth_request /auth;
  # Preflighted requests
  if ($request_method = OPTIONS) {
    return 200;
  }
  add_header Access-Control-Allow-Origin $http_origin always;
  add_header Access-Control-Allow-Methods "*";
  add_header Access-Control-Allow-Headers "Authorization, Origin, Content-Type";
nginx.ingress.kubernetes.io/server-snippet: |
  location ^~ /auth {
    internal;
    proxy_pass http://gatekeeper/$request_uri;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Method $request_method;
    proxy_set_header X-Forwarded-URI $request_uri;
    proxy_busy_buffers_size 64k;
    proxy_buffers 8 32k;
    proxy_buffer_size 32k;
  }

[p53]

not sure if you know, but right now you can get token with user/password with login handler and then you can pass token to gatekeeper https://gogatekeeper.github.io/gatekeeper/userguide/#endpoints, one more thing there is forward signing mode for gatekeeper, which will automate process of getting access token/refresment on client side for you, you then just have to point application to your client side proxy with HTTP_PROXY variables or use curl -x your_client_side_proxy, additionally with this setup you can use --enable-hmac on client side gatekeeper proxy and server side which will add HMAC signature to request, enhancing security, here is code for generating HMAC https://github.com/gogatekeeper/gatekeeper/blob/master/pkg/utils/utils.go#L440, will update docu with description, but basically it creates HMAC from authz header, body of request, method, host, so when hmac enabled and someone would stole somehow somebody tokens he cannot use it alone to create request, because he would need to sign request