How to extend Titiler to hit a STAC API using OAUTH 2

[dwyerb]

I have a requirement to configure a Titiler instance to interact with a STAC API (specifically stac-fastapi-pgstac) where the STAC API routes require OAUTH2 authentication. I have python code to authenticate to STAC. But it is not clear to me how to extend or configure Titiler so that the 'stac' routes use the code to authenticate to the api. I believe I need to add a dependency to the stac routes (ie routes with a router_prefix equal to 'stac').

Is this possible? Does anyone have an example of doing something similar?

[dwyerb]

I what I want to do, it create a dependency that validates and provides a keycloak token and then passes it along in the header of the request to the stac api. I have a script that uses the python requests library to query the stac api. The calls look like this:

requests.get( url=fastapi_url, headers={'Content-Type': 'text/plain',"Authorization": f"Bearer {keycloak_access_token}"} )

Is it possible to integrate something like that into a fastapi app that's calling another fastapi app?

[vincentsarago]

@dwyerb have you looked at https://github.com/stac-utils/titiler-pgstac ?

I believe I need to add a dependency to the stac routes (ie routes with a router_prefix equal to 'stac').

Yes

Is this possible? Does anyone have an example of doing something similar?

Yes, https://developmentseed.org/titiler/examples/code/tiler_with_auth/

But it is not clear to me how to extend or configure Titiler so that the 'stac' routes use the code to authenticate to the api.

I think the project you should look at is https://github.com/developmentseed/titiler-stacapi

It's a titiler module that connects to an external stac-API. There we forward the request headers https://github.com/developmentseed/titiler-stacapi/blob/main/titiler/stacapi/backend.py#L247 to the stac-api

maybe you can do this for single items in titiler.core by using a custom reader_dependency in order to set the fetch_options in rio-tiler.io.STACReader https://github.com/cogeotiff/rio-tiler/blob/main/rio_tiler/io/stac.py#L259 and then https://github.com/cogeotiff/rio-tiler/blob/main/rio_tiler/io/stac.py#L134

@dataclass(init=False)
class CustomReaderParams(DefaultDependency):

    fetch_options: Optional[Dict] = field(init=False)

    def __init__(self, request: Request):
        """Initialize BackendParams

        Note: Because we don't want `pool` to appear in the documentation we use a dataclass with a custom `__init__` method.
        FastAPI will use the `__init__` method but will exclude Request in the documentation making `pool` an invisible dependency.
        """
        self.fetch_options = {}
        
        auth = request.headers.get("Authorization", "")

        # Do Something

        self.fetch_options = {
            "headers": {"Authorization", auth}
        }

[dwyerb]

Vincent, thanks for responding. We are taking a look at titiler-pgstac now as we have a stac-fastapi intstance deployed. I think that will meet our requirements. Might look at titiler-stacapi as well. Thanks again.