Provide Support for Secure API Authentication

[VinodAnandan]

Current Behavior

Currently, we are utilising API keys, which are considered to have lower security compared to other secure API authentication methods.

Proposed Behavior

We should allow the external and centralised Authorisation Server (e.g., Keycloak) to handle the authentication and authorisation of clients in addition to API keys; it should be either API keys or centralised authentication.

So in practise, client will first authenticate with Authorisation Server using secure authentication mechanism like (OAuth 2.0 Client Credential Grant with Private Key JWT, OAuth 2.0 Client Credential Grant with Private Key JWT+DPoP, etc. ) and Keycloak will issue an access_token for the client, the client will use short lived access_token to call DT API endpoints. DT API will validate if the token issued by the trusted Authorisation server or not.

To enable this I think the DT should allow the JWKS endpoint for the Authorisation Server as a configuration and option to enable external secure API Auth.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[dhfherna]

I would like to work on this issue.

[VinodAnandan]

@dhfherna Thank you very much for offering your help so promptly; I truly appreciate it. These are just initial thoughts and ideas. I believe it would be beneficial to debate and discuss further before moving forward with implementation. I’ll also reach out to other DT team members for their feedback on this issue. In the meantime, if you have any questions or alternative ideas, please feel free to share them here.