Google Authentication support

[steeve]

trafficstars

Following https://github.com/bazelbuild/bazel/issues/12135, I figure I'd open an issue to track adding support for Google Auth access tokens in bazel-remote. This would allow exposing it on the internet.

There are two endpoints to verify tokens. I'm thinking of basically adding which domains one wants to authorize users from via the hd and email_verified keys.

[kragniz]

fwiw, fronting bazel-remote with a dedicated proxy service in the style of https://github.com/oauth2-proxy/oauth2-proxy will be more flexible and doesn't require this project to implement auth for all those auth providers

[mostynb]

fwiw, fronting bazel-remote with a dedicated proxy service in the style of https://github.com/oauth2-proxy/oauth2-proxy will be more flexible and doesn't require this project to implement auth for all those auth providers

It would be good to add some documentation for this setup- have you tried it already?

[kragniz]

I've not: the cluster I run can get by with no auth + security groups to avoid the latency overhead of checking auth

[steeve]

I've looked a oauth2-proxy, and unfortunately, it manages its own sessions: https://oauth2-proxy.github.io/oauth2-proxy/configuration/sessions

If you folks know if there is a proxy that would only valide tokens against Google's token-info, I'm all ears.