Add OAuth2 ClientCredentials flow support #1013
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
decko
added a commit
to decko/pulp-cli
that referenced
this pull request
Jul 22, 2024
decko
force-pushed
the
oauth2_support
branch
2 times, most recently
from
108a493 to
4462ff8
Compare
mdellweg
previously requested changes
Aug 15, 2024
mdellweg
reviewed
Aug 15, 2024
Comment on lines
52
to
69
| class OpenAPISecurityScheme: | ||
| def __init__(self, security_scheme: SecurityScheme): | ||
| self.security_scheme = security_scheme | ||
|
|
||
| self.parse() | ||
|
|
||
| def parse(self) -> None: | ||
| self.type = self.security_scheme["type"] | ||
| self.description = self.security_scheme.get("description", "") | ||
|
|
||
| if self.type == "oauth2": | ||
| self.flows: OAuth2Flows = self.security_scheme.get("flows") | ||
| client_credentials: ClientCredentials = self.flows["clientCredentials"] | ||
| if client_credentials: | ||
| self.flow_type: t.Optional[str] = "clientCredentials" | ||
| self.token_url: str = client_credentials["tokenUrl"] | ||
| self.scopes: OAuth2FlowsScopes = list(client_credentials.get("scopes").keys()) | ||
|
|
||
| if self.type == "http": | ||
| self.scheme = self.security_scheme["scheme"] |
There was a problem hiding this comment.
This is all kind of hazy.
Can you explain why the logic didn't fit in the authproviderbase call method?
There was a problem hiding this comment.
Does the AuthProviderBase need to understand how to properly parse an OpenAPI SecurityScheme for each of those authentication methods? I was thinking on abstracting this to AuthProviderBase and exposes the minimum needed to choose which method to call.
mdellweg
reviewed
Aug 15, 2024
mdellweg
reviewed
Aug 15, 2024
mdellweg
reviewed
Aug 15, 2024
|
I accidentally used wrong credentials and got the following traceback: |
|
Thanks @dkliban. We worked on that case and CLI is handling it fine now. Thanks. |
ggainey
dismissed
mdellweg’s stale review
Many of the changes made, and we're going to accept the result and refactor "soon"
ggainey
approved these changes
Aug 22, 2024
There was a problem hiding this comment.
Review suggests we really want to refactor how AuthBase deals with handling/prioritizing multiple-arbitrary-schemes. However, that will have to wait. The PR in its current state answers a pressing existing need, and is "correct enough" to be useful. Approving, while recognizing this is truly "tech preview" and we are likely going to make significant changes in this code flow.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This work adds OAuth2 ClientCredentials grant flow support to the Pulp-CLI.
Closes #926
We're going with the short-term pragmatic approach, and reserving the right to completely refactor this whole area soon
As test strategy, we have two options here:
1- Use the
responseslib (link here), a library that mocks therequestslib. With that we can intercept calls to a IdP mock to obtain a token, and then intercept the call to a Pulp instance and assert that there's theaccess_tokenbeing used with theAuthorizationheader.2- Mock an IdP using nginx rewrite module to return a 200 Ok message with an appropriate response to the token request. Together we need to configure the pulp server to provide the proper URL to allow pulp-cli to request a token and test an authorized operation on it.