AuthN & AuthZ
This page covers decisions and system architecture around the concept of authentication and authorization for TEMS.
Authentication is handled by IDPs. The default IDP for testing and first MVP is Duende Identity Server. Users data is stored in mongo db and managed by the separately deployable Identity Server from Duende.
Clients will have their own identity providers, therefore - it should be possible for TEMS to allow the use of SSO using client's identity provider.
During development and first phase of MVP, TEMS frontend will have a register component that will be used to create users, but later on - user creation will be moved outside of TEMS' scope as this isn't something TEMS should be responsible for, given that it will integrate with clients identity providers.
Authorization layer is represented by a Keycloak instance which could integrate with any IDP. Frontend knows only about Keycloak. Keycloak know about IDP.
Authorization type: Claims based (most probably) instead of role based. However, it is not excluded that we'll use both.
