feat(auth): Redirect to OpenShift login on empty auth request

[jan-law]

Related #717
Depends on cryostatio/cryostat-operator#292
Depends on cryostatio/cryostat-web#350

Edit: changed Fixes to Related as we will need a follow-up PR to add the logout feature

Screencast.from.2021-12-01.03.10.16.PM.mp4

As of now, I've also set the grantMethod to prompt. If a user logs into Cryostat via the OCP login page for the first time, they will see this page before they are redirected to the dashboard. Alternatively, I can set grantMethod: auto to hide this page. (OAuth Grant Options docs)

[andrewazores]

Despite my nitpicking of fine internal details, this looks excellent and I'm really excited to have it in a future release. It will really smooth out the user experience and makes it feel much more polished and well-integrated into the deployment platform.

[github-actions]

🎉 Great news! Looks like all the dependencies have been resolved:

• feat(auth): Add OAuth client to service account cryostat-operator#292
• feat(auth): Add OAuth redirect authentication cryostat-web#350

💡 To add or remove a dependency please update this issue/PR description.

Brought to you by Dependent Issues (:robot: ). Happy coding!

[andrewazores]

Awesome, seems to be working great.

One question I have, which is definitely out of the scope of this specific PR, is if we can somehow get the OAuth redirected login page to remember our credentials so that they don't need to be provided every time. Is there some cookie we need to set and send along with the request when we redirect the user to OAuth perhaps?

[jan-law]

Here's what happens if I login a second time. Do you mean to make a different request to the OAuth server if we already have a token to prevent another redirection?
I also believe you'll have to provide your credentials on the container platform login page again once the token expires after 24 hours.

Screencast.from.2021-12-10.11.57.48.AM.mp4

INFO: (10.129.0.1:42292): POST /api/v2.1/auth 302 74ms
Dec 10, 2021 4:57:51 PM io.cryostat.core.log.Logger info
INFO: (10.129.0.1:42294): GET /health 200 95ms
Dec 10, 2021 4:57:52 PM io.cryostat.core.log.Logger info
INFO: (10.129.0.1:42290): GET /api/v1/grafana_datasource_url 200 1ms
Dec 10, 2021 4:57:52 PM io.cryostat.core.log.Logger info
INFO: (10.129.0.1:42296): GET /api/v1/grafana_dashboard_url 200 2ms
Dec 10, 2021 4:57:52 PM io.cryostat.core.log.Logger info
INFO: (10.129.0.1:42292): GET /api/v1/notifications_url 200 2ms
Dec 10, 2021 4:57:53 PM io.cryostat.core.log.Logger info
INFO: (10.129.0.1:42296): POST /api/v2.1/auth 200 493ms

[andrewazores]

Hmm. Let me try that again with Chrome. I'm in Firefox and when I tried closing and re-opening the Cryostat tab, or even just F5 refreshing it, I was redirected back to the platform OAuth login page and had to re-enter my credentials. Maybe it's a browser-specific thing, or maybe it's one of my installed add-ons.

[andrewazores]

Nope, doesn't seem to be browser-specific. Same behaviour in Firefox, Chrome, and ungoogled-chromium. Maybe this is a CRC thing?

[andrewazores]

oauth-redirect-crc-2021-12-10_12.34.22.mp4

Here's what I see deployed in CRC and using Chrome in this video. The last OAuth login page at the end is from me pressing Ctrl-R.

[jan-law]

Maybe this is a CRC thing?

Possibly? Firefox and Chrome show the same behavior as what I posted above. Refreshing keeps you logged in.