SAML/SSO Authentication for Atlantis Web UI and API

[tedwardd]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

• I'd be willing to implement this feature (contributing guide)

Describe the user story

This proposal is a re-issuance of the proposal in #2999; "WebUI: saml / sso and per user permissions" which was closed "Completed" without changes having been implemented.

Describe the solution you'd like

The Atlantis Web UI provides somewhat privileged functionality in the form of the Disable Apply Commands button as well as the ability to discard and unlock specific plans. Providing this via an unauthenticated web UI is a major security concern for some organizations. While Atlantis currently supports HTTP Basic Auth with a shared username and password, this is not sufficient for organizations with security policies prohibiting the use of shared login credentials.

Atlantis should provide, at a minimum, a way to authenticate users via a SAML provider. Ideally, this would also open the door to user accounts and roles through which distinct access controls could be configured for users or groups of users.

Describe the drawbacks of your solution

At present, Atlantis does not strictly require a stateful backend to function properly. The only consequence to running Atlantis in a stateless manner is that a restart of the container/pod hosting Atlantis will lose any current locks and plan information. If this feature provides more than just authn and authz, it will require a stateful backend to maintain user profile information. I would strongly encourage limiting the features for this to authn and authz only to permit SAML configuration information, loaded at runtime, to suffice for this feature.

Describe alternatives you've considered

The only mechanism at this time for providing SAML based authentication is via a reverse proxy such as NGINX. This, however, only provides authn and does nothing for authz so it is not a complete solution.