User Account Control

DISCLAIMER! We make no claims or guarantees of this approach's security. If in doubt, enlist the help of an expert and conduct proper audits.

Making a viewer and its medical imaging data accessible on the open web can provide a lot of benefits, but requires additional security to make sure sensitive information can only be viewed by authorized individuals. Most image archives are equipped with basic security measures, but they are not robust/secure enough for the open web.

This guide covers one of many potential production setups that secure our sensitive data.

Overview

This guide builds on top of our Nginx + Orthanc guide, wherein we used a reverse proxy to retrieve resources from our image archive (Orthanc).

To add support for "User Account Control" we introduce Keycloak. Keycloak is an open source Identity and Access Management solution that makes it easy to secure applications and services with little to no code. We improve upon our reverse proxy setup by integrating Keycloak and Nginx to create an authenticating reverse proxy.

An authenticating reverse proxy is a reverse proxy that only retrieves the resources on behalf of a client if the client has been authenticated. If a client is not authenticated they can be redirected to a login page.

This setup allows us to...

https://www.nginx.com/blog/authenticating-users-existing-applications-openid-connect-nginx-plus/

Keycloak validates user identity using OAuth 2.0 and OpenID Connect for Google-based SSO

Requirements

Docker
- Docker for Mac
- Docker for Windows

Not sure if you have docker installed already? Try running docker --version in command prompt or terminal

Getting Started

Navigate to <project-root>/docker/OpenResty-Orthanc-Keycloak in your shell
Run docker volume create --name=keycloak_postgres_data
Run docker-compose build
Run docker-compose up

Create a new "Client" in Keycloak

What is a realm?
What is a client?
OAuth 2.0 and implict flow; why?
Can we set all of this up via config instead of manual?
Navigate to http://127.0.0.1/auth/admin/ in your browser. You should see:

Sign in with admin/password
Configure: Clients --> Create Client
- ClientID: pacs
- Client Protocol: openid-connect
- Click "save"
Under our new client's Settings tab:
- Client Protocol: openid-connect
- AccessType: Confidential
- Standard Flow: off
- Implicit Flow: on
- Direct Access: off
- Root URL: http://127.0.0.1
- Valid Redirect URIs: /callback*
- Web Origins: *
- Click "save"
Select the "Credentials" Tab
- Copy the secret value and save it for later
From the left hand sidebar, select Users
- Click "Add User"
  - Username: test
  - Email Verfied: ON
  - Click "Save"
- Select the "Credentials" Tab
  - New Password: test
  - Password Confirmation: test
  - Temporary: OFF
  - Click "Reset Password"

Rebuild Client

Set in config/nginx.conf?
- Env variable???
- 2dc6244a-1cba-4dbd-b3d6-f7409c2f68b3
stop, docker-compose up

Configuration

How it works

reverse proxy

A reverse proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. The resources from these servers are returned to the client as if they originate from the Web server itself.

OpenResty

OpenResty® is a full-fledged web platform that integrates the standard Nginx core, LuaJIT, many carefully written Lua libraries, lots of high quality 3rd-party Nginx modules, and most of their external dependencies. It is designed to help developers easily build scalable web applications, web services, and dynamic web gateways.

Lua Nginx Module access_by_lua_block

Next Steps

Deploying to Production

While these configuration and docker-compose files model an environment suitable for production, they are not easy to deploy "as is". You can either:

Manually recreate this environment and deploy built application files OR
Deploy to a cloud kubernetes provider like Digital Ocean OR
- See a full list of cloud providers here
Find and follow your preferred provider's guide on setting up swarms and stacks

Resources

The inspiration for our setup was driven largely by these articles:

For more documentation on the software we've chosen to use, you may find the following resources helpful:

5.7 KiB Raw Blame History