IAuth Interface Update: Removing User Management

[suhussai]

Hello everyone,

We’re considering an update to the IAuth interface that would remove user management capabilities. Currently, the interface requires implementers to provide a set of lambda functions for CRUD operations on users. For example, here’s the lambda that implements the create user functionality:

sbt-aws/src/control-plane/auth/auth-interface.ts

Line 170 in 7c2705c

readonly createUserFunction: IFunction;

These lambdas are attached to the Control Plane API Gateway and respond to requests to the /users endpoint. For instance, the create user lambda is set as the target for the POST /users endpoint of the Control Plane API here:

sbt-aws/src/control-plane/user-management/user-management.service.ts

Lines 44 to 52 in 7c2705c

	{
	method: apigatewayV2.HttpMethod.POST,
	scope: props.auth.createUserScope,
	path: usersPath,
	integration: new HttpLambdaIntegration(
	'tenantsHttpLambdaIntegration',
	props.auth.createUserFunction
	),
	},

Upon examination, SBT’s role in Control Plane user management is quite minimal:

1. It receives and authorizes requests to the /users endpoint on the SBT Control Plane.
2. It forwards the request to the Identity Provider’s (IdP) API.
3. It receives the response from the IdP and forwards it back to the caller.

Essentially, the SBT Control Plane acts as a proxy for the IdP’s API, which doesn’t provide significant value to users as they can directly access the IdP’s API. Furthermore, from a development and maintenance perspective, replicating and keeping up-to-date with the full set of capabilities provided by a given IdP for managing users requires considerable effort.

While the /users endpoint of Control Plane does provide the benefit of exchanging an SBT token for a token valid for the IdP’s API, this comes with drawbacks. It often means missing out on sophisticated access control mechanisms provided by the IdP’s API due to the complexity of mapping these back to SBT. We need to consider whether this benefit justifies the effort involved.

In conclusion, we’re proposing to remove the user management capabilities from the Control Plane API. We believe that the current implementation doesn’t justify the effort required, and users would be better served by communicating directly with the IdP’s API when managing Control Plane users.

We’d like to open this up for discussion. What are your thoughts on this proposed change?