Authentication of users Spline-UI with OpenID Connect or SAML2

[kumarsandeepramanath]

Hi Team,
We in our organization are using Spline-UI and we have deployed it using the WAR file.
However, the Spline-UI does not have any authentication mechanism and hence any user with the link to the application are now able to access the Spline-UI web application.
We would like to have only authenticated users to access the above web application.
In our organization, we are using the ForgeRock product and underlying it supports 2 protocols :

1. OpenID Connect
2. SAML 2
   Could you kindly let us know if it is possible to integrate either of the above protocols for the Spline-UI application ?
   If so, if you could kindly elaborate the steps for the same.
   Kindly revert for any clarification.

[wajda]

Hi Kumar Sandeep,
Sorry for the late response.
Currently we have no plans to implement any authentication mechanism in Spline UI. Since Spline UI is just a thin layer on top of the Spline Consumer REST API any authentication done on the UI tier only would be useless as nothing stops a cleaver user from querying unrestricted REST API directly, or even running his own local copy of the UI pointing to the production Spline REST API.

[wajda]

Implementing an AA on the Spline server side is on our road map, but is not a priority at the moment, so I cannot tell when and what will be implemented.

Regarding your case, as if I understand correctly, you don't really need any authorization, just authentication (a user gets full access once authenticated), I guess it can be achieved by a reverse proxy. I don't know what ready to use solution exists on the market at the moment. But unless I'm missing something it seems to be quite easy to achieve by a simple custom built application, that would expose two endpoints - one for UI stuff (html, js, css etc) and the other is for REST. Both endpoints would forward HTTP requests to the respected Spline services sitting behind the firewall. The authentication would be initiated by visiting the first endpoint, and after successful auth dance it would set a cookie that could be verified by the second endpoint that points to the Spline REST.

(I didn't try it myself, but I guess it should work)