Add a custom authentication to open service with secure access

[reminegrier]

Hi,

Currently working with Microsoft authentication, I embed the web app in an iframe and all works as expected.

I want to open the service to some users who doesn't belong to my AD, and, by the same way, authorize extern calls to a specific route I created on the Python API.

However, I don't want to grant access to everyone. I'd like to restrict access to the UI only from my iframe on one hand, and to my API route only for specific callers on the other hand.

I think the best way would be to disable Microsoft auth, and to secure calls with token, only known by the iframe embedder and API caller. It would be possible to custom getUserInfoList(), but is there a way to secure both UI App and Python API by the same way ?

Thanks