oauth2 filter: Make OAuth scopes configurable. by andreyprezotto · Pull Request #14034 · envoyproxy/envoy

andreyprezotto · 2020-11-16T12:56:01Z

Commit Message: Makes OAuth scopes configurable.
New optional parameter 'auth_scopes' added to the filter. The default value is 'user' (if not provided) to avoid breaking changes to users updating to the latest version.

Additional Description: Added log line to help debugging.
Risk Level: Low
Testing: Unit tests updated to match and cover the new parameter. Locally tested the generated docker image.
Docs Changes: Added the new parameter to the docs
Release Notes: Updated current.rst file
Platform Specific Features:
Fixes #13766

Signed-off-by: andreyprezotto <andreypp@gmail.com> Signed-off-by: andreyprezotto <andreyprezotto@iheartmedia.com>

Signed-off-by: andreyprezotto <andreypp@gmail.com>

This reverts commit 73d3ce1f343f36690b4a995c885fe0035f176b9e. Signed-off-by: andreyprezotto <andreypp@gmail.com>

This reverts commit a421de1628d5ae6591958fe1f2e61768927d4271. Signed-off-by: andreyprezotto <andreypp@gmail.com>

Signed-off-by: andreyprezotto <andreypp@gmail.com>

repokitteh-read-only · 2020-11-16T12:56:04Z

Hi @andreyprezotto, welcome and thank you for your contribution.

We will try to review your Pull Request as quickly as possible.

In the meantime, please take a look at the contribution guidelines if you have not done so already.

🐱

Caused by: #14034 was opened by andreyprezotto.

see: more, trace.

repokitteh-read-only · 2020-11-16T12:56:08Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/envoy/.
CC @envoyproxy/api-watchers: FYI only for changes made to api/envoy/.

🐱

Caused by: #14034 was opened by andreyprezotto.

see: more, trace.

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Signed-off-by: Kuat Yessenov <kuat@google.com>

…yproxy#14061) Signed-off-by: Adi Suissa-Peleg <adip@google.com>

I ended up burning several hours dealing with issues around this the other day, I'm hoping others don't :) Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

The client request stream can be deleted under the call stack of Envoy::IntegrationCodecClient::startRequest if the proxy replies quickly enough. Attempts to send an end stream on that request result in use-after-free on the client stream in cases where the client processed the full reply inside startRequest. Fixes envoyproxy#12960 Signed-off-by: Antonio Vicente <avd@google.com>

Signed-off-by: Greg Greenway <ggreenway@apple.com>

Signed-off-by: Sotiris Nanopoulos <sonanopo@microsoft.com>

Signed-off-by: JaredTan95 <jian.tan@daocloud.io>

…14099) This is a regression test to cover the issue underlying envoyproxy#14066. Risk level: Low Testing: Validating manually verify.sh passes, CI. Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Matt Klein <mklein@lyft.com> Signed-off-by: Christoph Pakulski <christoph@tetrate.io> Co-authored-by: Matt Klein <mklein@lyft.com> Co-authored-by: Christoph Pakulski <christoph@tetrate.io>

Signed-off-by: Bill Chung <bill@mercari.com>

- Requires removing --output_base flag to Bazel startup options - The TEST_TMPDIR and BUILD_DIR bind mounts from the host are where Bazel will place build output etc. - Allowing Bazel to place build and test output there will give the host access to the data to upload Signed-off-by: Sunjay Bhatia <sunjayb@vmware.com> Co-authored-by: William A Rowe Jr <wrowe@vmware.com>

…#14131) This fixes a regression which resulted in the downstreamRemoteAddress on the StreamInfo for a connection not having the address supplied by the proxy protocol filter, but instead having the address of the directly connected peer. This issue does not affect HTTP filters. Fixes envoyproxy#14087 Signed-off-by: Greg Greenway <ggreenway@apple.com>

… is marked dead by Lua GC (envoyproxy#14092) Fixes envoyproxy#14091 The problem and fix is similiar to envoyproxy#4312 Risk Level: Low Testing: regression test, manual testing Docs Changes: N/A Release Notes: N/A Signed-off-by: Marcin Falkowski <marcin.falkowski@allegro.pl>

Signed-off-by: andreyprezotto <andreypp@gmail.com>

- auth_scopes is now repeated string - scope values are now URL encoded in the request Signed-off-by: andreyprezotto <andreypp@gmail.com>

repokitteh-read-only · 2020-11-24T19:55:01Z

CC @envoyproxy/dependency-shepherds: Your approval is needed for changes made to (bazel/.*repos.*\.bzl)|(bazel/dependency_imports\.bzl)|(api/bazel/.*\.bzl)|(.*/requirements\.txt)|(.*\.patch).

🐱

Caused by: #14034 was synchronize by andreyprezotto.

see: more, trace.

andreyprezotto · 2020-11-24T20:12:08Z

Closing this PR as I pushed my rebased branch into it, and the changes are now messy.
I will issue a new PR to replace this one.

andreyprezotto and others added 25 commits November 16, 2020 08:24

Add scope to oauth2 filter proto file

80acc89

Signed-off-by: andreyprezotto <andreypp@gmail.com> Signed-off-by: andreyprezotto <andreyprezotto@iheartmedia.com>

Use configured scopes in authorizarion request

c276e54

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Initialize member in the correct order

d26dd3a

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Update proto files after proto_format.sh

1577ed6

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Fix oauth filter tests

47f1fa4

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix semicolon

906a91f

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix tests

94fa8b1

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix tests

2fdf64a

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix tests after rebase

7c689b9

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Add debug log for test

6549060

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Add debug log for test

5e709f9

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Auth_scope default value if config wasn't set

c2567ec

Signed-off-by: andreyprezotto <andreypp@gmail.com>

add config test for default user

657e21f

Signed-off-by: andreyprezotto <andreypp@gmail.com>

add config test for default user

a7acd87

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Revert "Auth_scope default value if config wasn't set"

5381f74

This reverts commit 73d3ce1f343f36690b4a995c885fe0035f176b9e. Signed-off-by: andreyprezotto <andreypp@gmail.com>

Revert "Revert "Auth_scope default value if config wasn't set""

4d9eab9

This reverts commit a421de1628d5ae6591958fe1f2e61768927d4271. Signed-off-by: andreyprezotto <andreypp@gmail.com>

revert implementation

5e126b9

Signed-off-by: andreyprezotto <andreypp@gmail.com>

change defaul value implementation

b64e322

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix with .empty

7359ad3

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix semicolon

62f1ff4

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix property name

b3c2071

Signed-off-by: andreyprezotto <andreypp@gmail.com>

semicolon

a18a184

Signed-off-by: andreyprezotto <andreypp@gmail.com>

fix tests

2aa7274

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Add auth_scopes to the docs

a097339

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Update Release Notes

47598a2

Signed-off-by: andreyprezotto <andreypp@gmail.com>

repokitteh-read-only bot added the api label Nov 16, 2020

andreyprezotto added 2 commits November 16, 2020 10:17

Fix colon in docs

6cca203

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Fix release notes

a5d64d0

Signed-off-by: andreyprezotto <andreypp@gmail.com>

kyessenov and others added 18 commits November 24, 2020 16:46

wasm: fix network leak (envoyproxy#13836)

0026696

Signed-off-by: Kuat Yessenov <kuat@google.com>

http2: fixing upstream sending metadata after ending the stream (envo…

b1d1fc0

…yproxy#14061) Signed-off-by: Adi Suissa-Peleg <adip@google.com>

test: improve docs and robustness of coverage script. (envoyproxy#14021)

c72c15c

I ended up burning several hours dealing with issues around this the other day, I'm hoping others don't :) Signed-off-by: Harvey Tuch <htuch@google.com>

tls: update BoringSSL to 1ce6682c (4280). (envoyproxy#14072)

783b773

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

buffer: add a method for getting only the first slice (envoyproxy#14050)

22a820b

Signed-off-by: Greg Greenway <ggreenway@apple.com>

[Level Events] manage level events registration mask (envoyproxy#13787)

e73172e

Signed-off-by: Sotiris Nanopoulos <sonanopo@microsoft.com>

examples: Update SkyWalking version (envoyproxy#13938)

e0a80c4

Signed-off-by: JaredTan95 <jian.tan@daocloud.io>

examples: add VRP runtime validation to verify_examples. (envoyproxy#…

723475a

…14099) This is a regression test to cover the issue underlying envoyproxy#14066. Risk level: Low Testing: Validating manually verify.sh passes, CI. Signed-off-by: Harvey Tuch <htuch@google.com>

udp: properly handle truncated/dropped datagrams (envoyproxy#14122)

ab6e2ff

Signed-off-by: Matt Klein <mklein@lyft.com> Signed-off-by: Christoph Pakulski <christoph@tetrate.io> Co-authored-by: Matt Klein <mklein@lyft.com> Co-authored-by: Christoph Pakulski <christoph@tetrate.io>

mongo: swap cx destroy metrics (envoyproxy#13991)

ca66519

Signed-off-by: Bill Chung <bill@mercari.com>

Fix release notes

40aaf60

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Fix formatting

c8d39ea

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Fix documentation

446df5e

Signed-off-by: andreyprezotto <andreypp@gmail.com>

Code review changes

57cfd34

- auth_scopes is now repeated string - scope values are now URL encoded in the request Signed-off-by: andreyprezotto <andreypp@gmail.com>

andreyprezotto requested review from PiotrSikora, alyssawilk, asraa, dio, ggreenway, lizan and mattklein123 as code owners November 24, 2020 19:54

repokitteh-read-only bot added the deps Approval required for changes to Envoy's external dependencies label Nov 24, 2020

andreyprezotto closed this Nov 24, 2020

andreyprezotto mentioned this pull request Nov 24, 2020

oauth2 filter: Make OAuth scopes configurable. #14168

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

oauth2 filter: Make OAuth scopes configurable.#14034

oauth2 filter: Make OAuth scopes configurable.#14034
andreyprezotto wants to merge 75 commits intoenvoyproxy:masterfrom
andreyprezotto:oauth_scope_enhanc

andreyprezotto commented Nov 16, 2020

Uh oh!

repokitteh-read-only bot commented Nov 16, 2020

Uh oh!

repokitteh-read-only bot commented Nov 16, 2020

Uh oh!

repokitteh-read-only bot commented Nov 24, 2020

Uh oh!

andreyprezotto commented Nov 24, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

andreyprezotto commented Nov 16, 2020

Uh oh!

repokitteh-read-only bot commented Nov 16, 2020

Uh oh!

repokitteh-read-only bot commented Nov 16, 2020

Uh oh!

repokitteh-read-only bot commented Nov 24, 2020

Uh oh!

andreyprezotto commented Nov 24, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants