@julian diving into the hard problems of building for the Fediverse at #Fedicon, starting with hilariously talking about how those hard problems look like to average users 😅
-
@naturzukunft @julian @thisismissem that's fine; you should do whatever it is you want.
@naturzukunft @julian @thisismissem oh, are you going to use Keycloak's built in user database, or are you going to use an adapter to fetch user data from your own database?
-
@naturzukunft @julian @thisismissem oh, are you going to use Keycloak's built in user database, or are you going to use an adapter to fetch user data from your own database?
@naturzukunft @julian @thisismissem oh, it looks like Authentik has ways to do client metadata lookup with a Webhook. Nice!
-
@naturzukunft @julian @thisismissem oh, are you going to use Keycloak's built in user database, or are you going to use an adapter to fetch user data from your own database?
@evan @julian @thisismissem which user data to do what ?
-
@evan @julian @thisismissem which user data to do what ?
@naturzukunft @julian @thisismissem oh, sorry. By default, KeyCloak stores all the user data (name, avatar, description, so on) in its own internal PostgreSQL database, and you get an API to ask about and manage users.
The alternative is to add a custom UserStorageProvider class to access your own user storage and map your data to KeyCloak's schema. Applications that already have a user database often do this.
-
@naturzukunft @julian @thisismissem oh, sorry. By default, KeyCloak stores all the user data (name, avatar, description, so on) in its own internal PostgreSQL database, and you get an API to ask about and manage users.
The alternative is to add a custom UserStorageProvider class to access your own user storage and map your data to KeyCloak's schema. Applications that already have a user database often do this.
@evan @naturzukunft @julian in the wild it's very uncommon to replace Keycloak's user database with something else; most commonly user migrations are performed, having been involved in several such projects.
-
@naturzukunft @julian @thisismissem oh, are you going to use Keycloak's built in user database, or are you going to use an adapter to fetch user data from your own database?
@evan @julian @thisismissem There is a mapping in the resource server between PreferredUsername and an actor. This is a hack; I had to extend it because Mastodon uses the username as a unique identifier. Without Mastodon support, it would be a mapping between IssuerUserId and Actor. The data for the mapping comes from the JWT token.
But that's beside the point.
-
@evan @naturzukunft @julian in the wild it's very uncommon to replace Keycloak's user database with something else; most commonly user migrations are performed, having been involved in several such projects.
@thisismissem @julian great, so that's what
@naturzukunft can do. -
@evan @julian @thisismissem There is a mapping in the resource server between PreferredUsername and an actor. This is a hack; I had to extend it because Mastodon uses the username as a unique identifier. Without Mastodon support, it would be a mapping between IssuerUserId and Actor. The data for the mapping comes from the JWT token.
But that's beside the point.
@naturzukunft @julian @thisismissem I think your point was that any configuration that requires adding plugins or adapters for KeyCloak is a bad architecture, and you're committed to using KC entirely off-the-shelf.
-
@evan @julian @thisismissem There is a mapping in the resource server between PreferredUsername and an actor. This is a hack; I had to extend it because Mastodon uses the username as a unique identifier. Without Mastodon support, it would be a mapping between IssuerUserId and Actor. The data for the mapping comes from the JWT token.
But that's beside the point.
@naturzukunft @evan @julian we have a userinfo endpoint now in mastodon that gives you a unique subject (sub) claim: https://docs.joinmastodon.org/methods/oauth/#userinfo
This is all discoverable via standards that exist in OAuth (with a touch of OIDC language)
-
@naturzukunft @julian @thisismissem I think your point was that any configuration that requires adding plugins or adapters for KeyCloak is a bad architecture, and you're committed to using KC entirely off-the-shelf.
@evan @naturzukunft @julian as Client ID Metadata Documents move through the standards process, I would assume keycloak will adopt them and Client ID Prefixes.
-
@evan @naturzukunft @julian as Client ID Metadata Documents move through the standards process, I would assume keycloak will adopt them and Client ID Prefixes.
@evan @naturzukunft @julian but keycloak being able to understand wtf a json-ld document of type Service or Application is? Incredibly unlikely, especially when the contents within isn't even remotely aligned with the IANA registry for Dynamic Client Registration Metadata values.
-
@evan @naturzukunft @julian as Client ID Metadata Documents move through the standards process, I would assume keycloak will adopt them and Client ID Prefixes.
@thisismissem @naturzukunft @julian but they don't work right now, out of the box? I think that doesn't meet his requirements then.
-
@evan @naturzukunft @julian but keycloak being able to understand wtf a json-ld document of type Service or Application is? Incredibly unlikely, especially when the contents within isn't even remotely aligned with the IANA registry for Dynamic Client Registration Metadata values.
@thisismissem @julian sorry, I don't know what you're talking about.
KeyCloak has an extension mechanism and you can use it to retrieve a Client object from somewhere besides the built-in database. But someone needs to write that plugin. @naturzukunft said it wasn't acceptable for him to use any kind of extension or plugin.
-
@naturzukunft @evan @julian we have a userinfo endpoint now in mastodon that gives you a unique subject (sub) claim: https://docs.joinmastodon.org/methods/oauth/#userinfo
This is all discoverable via standards that exist in OAuth (with a touch of OIDC language)
@thisismissem @naturzukunft @julian hey, that brings up a great point. Does Mastodon support clients using OAuth for accessing the read-only parts of the API (reading an actor, reading an outbox, reading a note)? I've done it with no authentication and with HTTP Signatures but I don't know if you can use OAuth. That would be a huge step in the right direction.
-
@thisismissem @naturzukunft @julian but they don't work right now, out of the box? I think that doesn't meet his requirements then.
@evan @naturzukunft @julian because we're an internet draft in front of the OAuth Working Group at IETF and we're having to balance a dozen different needs and compatibility issues. But we already have adoption in some places (bluesky/AT Proto being one of the most notable adopters)
-
@thisismissem @naturzukunft @julian hey, that brings up a great point. Does Mastodon support clients using OAuth for accessing the read-only parts of the API (reading an actor, reading an outbox, reading a note)? I've done it with no authentication and with HTTP Signatures but I don't know if you can use OAuth. That would be a huge step in the right direction.
@evan @naturzukunft @julian not for AP, because we're don't support anything related to C2S. We could add OAuth support there theoretically, but it's not a priority right now.
-
@evan @naturzukunft @julian not for AP, because we're don't support anything related to C2S. We could add OAuth support there theoretically, but it's not a priority right now.
@thisismissem @naturzukunft @julian right, but the ActivityPub API is not just about posting activities to the `outbox`. It also includes reading all the actors, collections and objects in the Activity Streams 2.0 format.
Anyways, I might look into it and make an issue and PR. If it worked properly, you could do a decent read-only application with the ActivityPub API, without making any commitment to the client-to-server part of the spec. That'd be a nice step forward for the API.
-
@thisismissem @naturzukunft @julian right, but the ActivityPub API is not just about posting activities to the `outbox`. It also includes reading all the actors, collections and objects in the Activity Streams 2.0 format.
Anyways, I might look into it and make an issue and PR. If it worked properly, you could do a decent read-only application with the ActivityPub API, without making any commitment to the client-to-server part of the spec. That'd be a nice step forward for the API.
@evan @naturzukunft @julian talk to the team first. Doing changes here is not simple.
-
@evan @naturzukunft @julian talk to the team first. Doing changes here is not simple.
@thisismissem @naturzukunft @julian @MastodonEngineering that was on my agenda.
-
I'm still catching up on this conversation, but I just want to add that this analysis is spot on. Very well said, Julian. Thank you!
I'm collecting a few thoughts on this that won't fit into a toot, so I'll probably post them elsewhere and link back here once I get it together.
