#437 implements a basic authentication and permissions RBAC system using JWTs, but it had to come with the following warning:
Permissions are an experimental feature in Matchbox. Disable them with MB__SERVER__AUTHORISATION=False.
Sadly we ran out of time to add features like OAuth, SAML, password registration, or API keys as alternative. Assuming keys and JWTs are readily available is just not realistic for anywhere but our internal data estate.
A library like fastapi-users likely sets out sensible defaults here, sadly found too late.
Acceptance
#437 implements a basic authentication and permissions RBAC system using JWTs, but it had to come with the following warning:
Sadly we ran out of time to add features like OAuth, SAML, password registration, or API keys as alternative. Assuming keys and JWTs are readily available is just not realistic for anywhere but our internal data estate.
A library like fastapi-users likely sets out sensible defaults here, sadly found too late.
Acceptance