feat(idtoken-auth): add auth validator using google idtoken #349

swallowstalker · 2023-01-17T09:30:20Z

Add google idtoken (OIDC) auth validator on grpc interceptor, to provide login via google SSO

How to use it

Just add this line to config.yaml (sample is on internal/server/config.yaml)

AUTH:
  PROVIDER: default   # can be "default" or "oidc"
  DEFAULT:
    # AUTHENTICATED_USER_HEADER_KEY takes priority for backward-compatibility
    HEADER_KEY: X-Auth-Email   
  OIDC:
    # add google client audience
    AUDIENCE: "some-kind-of-audience.com"  
    # add eligible email domains for your organization, empty string means that no checking will be done
    ELIGIBLE_EMAIL_DOMAINS: "emaildomain1.com,emaildomain2.com"

Tests

Without any request header

curl --location --request GET 'http://localhost:3000/api/v1beta1/appeals'

Response: 401 Unauthorized

{
    "code": 16,
    "message": "invalid authentication credentials"
}

With `Authorization` header containing `idtoken` from google SSO

curl --location --request GET 'http://localhost:3000/api/v1beta1/appeals' \
--header 'Authorization: Bearer <idtoken>'

Response: 200 OK (no list of appeals yet because it's empty)

{}

bsushmith · 2023-01-18T11:12:52Z

@swallowstalker can you create an issue along with details what this feature is about and what it will solve, and link it with this PR ?

swallowstalker · 2023-01-18T13:11:49Z

@swallowstalker can you create an issue along with details what this feature is about and what it will solve, and link it with this PR ?

sure, will create it shortly. sorry if there's only very short description and background about this PR

swallowstalker · 2023-01-18T13:33:57Z

@bsushmith here is the issue #350

…or default auth header key

internal/server/config.go

pkg/auth/oidc.go

…ams is nil

swallowstalker · 2023-01-31T13:41:31Z

@swallowstalker one more thing i noticed, we can move the mocks in the same package for which it is used. You can refer to other mocks implementations and placement.

I have moved OIDCValidator mock to pkg/auth/mocks directory 👍

internal/server/server.go

internal/server/config.go

ravisuhag · 2023-02-07T20:16:34Z

@swallowstalker Please see if you can find some time to fix test and the above mentioned comment. We can go ahead and merge it then

swallowstalker · 2023-02-07T23:29:30Z

@swallowstalker Please see if you can find some time to fix test and the above mentioned comment. We can go ahead and merge it then

sorry i was oncall last week. will fix that in few days

… different context key for oidc email

…der (it's only used for logrus)

pkg/auth/oidc.go

internal/server/server.go

…trieve its value from context

…r grpc server

rahmatrhd

LGTM

rahmatrhd · 2023-02-16T03:54:45Z

@swallowstalker I've created v0.6.0-alpha.1 release, you can use this to test from your side 🙂

ravisuhag · 2023-02-16T08:22:34Z

@swallowstalker Thanks a lot for your contribution :)

* feat(idtoken-auth): add auth validator using google idtoken (#349) * docs: add idtoken validation on sample config.yaml * feat: add auth config to replace idtoken validator config, and refactor default auth header key * refactor: move auth interceptor to pkg/auth * chore: delete idtoken validator mock * feat: keep config.AuthenticatedUserHeaderKey for backward-compatibility * chore: re-order import * refactor: change sample config.yaml for auth config * chore: make auth user header key sample and default config consistent * chore: re-order import on oidc test * fix: change oidc initialism * fix: oidc validator mocks renaming * fix: avoid using params with pointer, as it will lead to panic if params is nil * fix: detect old auth user header key using empty string instead of default tag * refactor: move OIDCAuth to pkg/auth * refactor: move oidc validator mocks into pkg/auth/mocks * chore: add deprecation notes on AuthenticatedUserHeaderKey * refactor: make default auth email context key back to unexported, use different context key for oidc email * refactor: do not use default header key on oidc auth, use its own header (it's only used for logrus) * refactor: move logrus context custom fields to new interceptor and retrieve its value from context * refactor: auth email context key mapping for default and oidc used for grpc server * test: change ways of getting user email from request header to context * refactor: use auth.OIDCAuth instead of OIDCValidatorParams * feat(gcs): support import grants for gcs provider (#360) * feat(gcs): support import grants for gcs provider * refactor(gcs): use projectID value from struct field and remove from GetBuckets' param * refactor(gcs): refactor repeated logic to retrieve gcs client * refactor(gcs): improve code readability * fix(gcs): exclude deleted principals (#364) * refactor(gcs): use account type whitelisting * fix(gcs): exclude deleted principals * fix(gcs): fix timeout by running getPolicy in parallel (#365) --------- Co-authored-by: Pulung Ragil <[email protected]>

swallowstalker changed the title ~~draft: feat(idtoken-auth): add auth validator using google idtoken~~ feat(idtoken-auth): add auth validator using google idtoken Jan 18, 2023

swallowstalker marked this pull request as ready for review January 18, 2023 10:15

swallowstalker requested review from ravisuhag, rahmatrhd, AkarshSatija, mabdh and bsushmith as code owners January 18, 2023 10:15

swallowstalker mentioned this pull request Jan 18, 2023

Add authentication to guardian using google idtoken (from google SSO login) #350

Closed

ravisuhag linked an issue Jan 19, 2023 that may be closed by this pull request

Add authentication to guardian using google idtoken (from google SSO login) #350

Closed

swallowstalker added 3 commits January 24, 2023 21:02

feat(idtoken-auth): add auth validator using google idtoken

94426a6

docs: add idtoken validation on sample config.yaml

583ebdd

feat: add auth config to replace idtoken validator config, and refact…

2e9c4a1

…or default auth header key

swallowstalker force-pushed the feat/idtoken-auth-validator branch from b45d454 to 2e9c4a1 Compare January 24, 2023 14:05

swallowstalker added 8 commits January 24, 2023 21:24

refactor: move auth interceptor to pkg/auth

be6195f

chore: delete idtoken validator mock

236ddf0

feat: keep config.AuthenticatedUserHeaderKey for backward-compatibility

5149a63

chore: re-order import

b0d3434

refactor: change sample config.yaml for auth config

44bade7

chore: make auth user header key sample and default config consistent

41bc1dc

chore: re-order import on oidc test

2dbd756

Merge branch 'remotemain' into feat/idtoken-auth-validator

26b660e

mabdh reviewed Jan 26, 2023

View reviewed changes

internal/server/config.go Outdated Show resolved Hide resolved

mabdh reviewed Jan 26, 2023

View reviewed changes

pkg/auth/oidc.go Outdated Show resolved Hide resolved

mabdh reviewed Jan 26, 2023

View reviewed changes

pkg/auth/oidc.go Show resolved Hide resolved

swallowstalker added 3 commits January 27, 2023 22:42

fix: change oidc initialism

7c9bdd0

fix: oidc validator mocks renaming

2972cd9

fix: avoid using params with pointer, as it will lead to panic if par…

57c7a94

…ams is nil

Merge branch 'main' into feat/idtoken-auth-validator

c9fb2ad

rahmatrhd requested changes Jan 31, 2023

View reviewed changes

internal/server/server.go Outdated Show resolved Hide resolved

rahmatrhd reviewed Jan 31, 2023

View reviewed changes

internal/server/config.go Show resolved Hide resolved

swallowstalker added 4 commits February 9, 2023 10:52

Merge branch 'main' into feat/idtoken-auth-validator

4afaf7b

chore: add deprecation notes on AuthenticatedUserHeaderKey

e18032d

refactor: make default auth email context key back to unexported, use…

a4c5b77

… different context key for oidc email

refactor: do not use default header key on oidc auth, use its own hea…

1ba4663

…der (it's only used for logrus)

rahmatrhd requested changes Feb 10, 2023

View reviewed changes

pkg/auth/oidc.go Outdated Show resolved Hide resolved

internal/server/server.go Outdated Show resolved Hide resolved

swallowstalker added 4 commits February 14, 2023 11:18

refactor: move logrus context custom fields to new interceptor and re…

2d00704

…trieve its value from context

refactor: auth email context key mapping for default and oidc used fo…

47ffd06

…r grpc server

test: change ways of getting user email from request header to context

dd23032

refactor: use auth.OIDCAuth instead of OIDCValidatorParams

526f014

rahmatrhd changed the base branch from main to 0.6.x February 14, 2023 06:30

rahmatrhd requested a review from ravisuhag February 14, 2023 07:15

swallowstalker requested review from rahmatrhd and ravisuhag and removed request for ravisuhag, AkarshSatija, mabdh, bsushmith and rahmatrhd February 15, 2023 03:57

rahmatrhd approved these changes Feb 15, 2023

View reviewed changes

mabdh merged commit a4b0c5d into raystack:0.6.x Feb 16, 2023

rahmatrhd mentioned this pull request Feb 20, 2023

feat: v0.6.0 #366

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(idtoken-auth): add auth validator using google idtoken #349

feat(idtoken-auth): add auth validator using google idtoken #349

swallowstalker commented Jan 17, 2023 •

edited

Loading

bsushmith commented Jan 18, 2023

swallowstalker commented Jan 18, 2023

swallowstalker commented Jan 18, 2023

swallowstalker commented Jan 31, 2023

ravisuhag commented Feb 7, 2023

swallowstalker commented Feb 7, 2023

rahmatrhd left a comment

rahmatrhd commented Feb 16, 2023

ravisuhag commented Feb 16, 2023

feat(idtoken-auth): add auth validator using google idtoken #349

feat(idtoken-auth): add auth validator using google idtoken #349

Conversation

swallowstalker commented Jan 17, 2023 • edited Loading

How to use it

Tests

Without any request header

With Authorization header containing idtoken from google SSO

bsushmith commented Jan 18, 2023

swallowstalker commented Jan 18, 2023

swallowstalker commented Jan 18, 2023

swallowstalker commented Jan 31, 2023

ravisuhag commented Feb 7, 2023

swallowstalker commented Feb 7, 2023

rahmatrhd left a comment

Choose a reason for hiding this comment

rahmatrhd commented Feb 16, 2023

ravisuhag commented Feb 16, 2023

swallowstalker commented Jan 17, 2023 •

edited

Loading

With `Authorization` header containing `idtoken` from google SSO