Authentication enhancement

[dylanmcreynolds]

The tiledviewer component needs to more gracefully handle authenticating into Tiled. Currently it takes an api_key, either passed in through the props or, as of right now, pasted in through the UI of the tiled browser. This is sufficient for development and for very friendly users but not a long term solution.

Solving this has one significant challenge. There is not, as far as I know, any browser-based ui for logging users into tiled in a general purpose manner. This extremely stale PR was an attempt, but it never went anywhere. Solving this piece of the puzzle in a way that could be called by the Tiled Browser component would be amazing. Maybe a react component that could be opened as a modal dialog? How would it's login be communicated back so that the Tiled Browser would used it...set a cookie? Pass a bearer token to back to the Tiled Browser to send with every request?

@danielballan, any thoughts?

[danielballan]

@AditiChikkali, having recently addressed bit rot in Tiled's built-in React prototype and added tests has this on her plate next. Collaboration welcome, as always.

[danielballan]

As far as the mechanics go, still like the direction we were headed in with our very stale PR. The UI needs to obtain a refresh/access token pair, and then just keep the tokens fresh.

The complexity comes from:

• Tiled can be configured to deploy public servers that do not require auth to see at least some data (like https://tiled-demo.blueskyproject.io/) or private servers that require authentication (like tiled.nsls2.bnl.gov).
• Tiled supports two ways of initializing auth: through a third party with code flow or through directly handing username/password to Tiled over HTTP Basic. Either route leads to a refresh/access token pair and OAuth2 from there.
• Tiled supports multiple auth providers (like Globus does). I strongly question this design choice in retrospect. As far as I know, no one has used it yet. Having one provider would make so many things simpler. If I understand correctly, SciCat used to support multiple as well, and made the choice to drop that and limit to a single one. If that's correct, that's a strong signal we should consider doing the same

[dylanmcreynolds]

I would love for you to look at this as well, @SeijDeLeon, in relation to how this could be used by the Tiled Browser in finch.

[dylanmcreynolds]

@SeijDeLeon and I discussed this a bit this morning. It would be wonderful if TiledViewer could send the user to the stock Tiled app (once it has authentication built in). Can it be done by opening an iframe or other tab from the TiledViewer to the Tiled and using the postMessage api? This would require coordination on both sides.

Seij and I talked about maybe building the auth ui in TiledViewer now, and then investigating how to share the code with the stock tiled app when it's done. But I don't want to duplicate efforts if @AditiChikkali is also working on this from the Tiled side.