Apply web application that can make authentication requests with user token #16488

vinokurig · 2020-03-30T13:13:57Z

What does this PR do?

Currently oAuth requests are not allowed to use machine token, so this web app loads a keycloak token on start and opens the oauth authenticate popup with the help of the keycloak token. If we need to get the oauth provider's token the web app send a user token to the window which opened the app. Then the client that opened the app will receive a user token which can be used for other oAuth requests like getToken().

How to test:

Setup a github oauth client: https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app
Setup a github identity in the keycloak admin page.

Paste the client id and client secret from the gihub oauth app.
Paste the redirect url to the github oauth app.

2. open the web app by url <che-url>/_app/oauth.html?oauth_provider=github

What issues does this PR fix or reference?

#15261

Release Notes

Docs PR

… token Signed-off-by: Igor Vinokur <ivinokur@redhat.com>

che-bot · 2020-03-30T13:31:28Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

assembly/assembly-root-war/src/main/webapp/_app/oauthLoader.js

…th user token

che-bot · 2020-03-31T09:06:27Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

skabashnyuk · 2020-03-31T09:28:43Z

assembly/assembly-root-war/src/main/webapp/_app/oauthLoader.js

+}
+
+function sendToken(token) {
+    if (window.opener) {


it would be reasonable to check if window.opener points to the workspace that belongs to the current user.

I can't read the opener's url. It is blocked by browser restrictions:

Exception: DOMException: Blocked a frame with origin "http://che-che.192.168.99.253.nip.io" from accessing a cross-origin frame. at sendToken (http://che-che.192.168.99.253.nip.io/_app/oauthLoader.js:86:26)<error: SecurityError: Blocked a frame with origin "http://che-che.192.168.99.253.nip.io" from accessing a cross-origin frame.<error> at http://che-che.192.168.99.253.nip.io/_app/oauthLoader.js:132:13]

I added a check that compares machine token received from parent window and the keycloak token: https://github.com/eclipse/che/blob/2e31d1208863509be770d0ce8cee91dcedf18025/assembly/assembly-root-war/src/main/webapp/_app/oauthLoader.js#L123-L143

…th user token

che-bot · 2020-04-01T09:28:05Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

…th user token

che-bot · 2020-04-02T14:47:40Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

…th user token

che-bot · 2020-04-03T08:09:44Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

…th user token

che-bot · 2020-04-08T07:53:06Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

vinokurig · 2020-04-08T07:54:49Z

crw-ci-test

che-bot · 2020-04-08T08:00:49Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

…uests with user token" This reverts commit 182142f.

che-bot · 2020-04-08T08:15:33Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:16488

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

Apply web application that can make authentication requests with user…

f6c41d0

… token Signed-off-by: Igor Vinokur <ivinokur@redhat.com>

vinokurig requested review from ibuziuk, l0rd, mshaposhnik, nickboldt, rhopp, skabashnyuk and sleshchenko as code owners March 30, 2020 13:13

che-bot added status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. kind/enhancement A feature request - must adhere to the feature request template. labels Mar 30, 2020

Merge branch 'master' of github.com:eclipse/che into che-15261

500983e

skabashnyuk reviewed Mar 31, 2020

View reviewed changes

assembly/assembly-root-war/src/main/webapp/_app/oauthLoader.js Outdated Show resolved Hide resolved

fixup! Apply web application that can make authentication requests wi…

5e45da3

…th user token

skabashnyuk reviewed Mar 31, 2020

View reviewed changes

fixup! Apply web application that can make authentication requests wi…

2e31d12

…th user token

vinokurig mentioned this pull request Apr 1, 2020

Add an ability to sign requests with user token eclipse-che/che-workspace-client#30

Merged

ericwill mentioned this pull request Apr 1, 2020

Plugins Sprint 182 #16513

Closed

47 tasks

skabashnyuk approved these changes Apr 2, 2020

View reviewed changes

This was referenced Apr 2, 2020

Configure OpenShift oAuth client for the OpenShift oAuth provider by operator #16199

Closed

Use keycloak token for oAuth requests eclipse-che/che-theia#694

Merged

vinokurig added 2 commits April 2, 2020 17:19

Merge branch 'master' of github.com:eclipse/che into che-15261

785b316

fixup! Apply web application that can make authentication requests wi…

d096cd9

…th user token

fixup! Apply web application that can make authentication requests wi…

2e7086a

…th user token

vinokurig added 2 commits April 6, 2020 09:43

Merge branch 'master' of github.com:eclipse/che into che-15261

91a7150

Merge branch 'master' of github.com:eclipse/che into che-15261

c63ecab

vinokurig added 2 commits April 8, 2020 10:10

Merge branch 'master' of github.com:eclipse/che into che-15261

d6e38d9

fixup! Apply web application that can make authentication requests wi…

182142f

…th user token

Revert "fixup! Apply web application that can make authentication req…

e6b4c9b

…uests with user token" This reverts commit 182142f.

vinokurig merged commit 5c20e0e into master Apr 8, 2020

vinokurig deleted the che-15261 branch April 8, 2020 08:48

che-bot removed the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Apr 8, 2020

vinokurig mentioned this pull request Apr 17, 2020

che-15261: Update with upstream che redhat-developer/rh-che#1865

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Apply web application that can make authentication requests with user token #16488

Apply web application that can make authentication requests with user token #16488

vinokurig commented Mar 30, 2020 •

edited

Loading

che-bot commented Mar 30, 2020

che-bot commented Mar 31, 2020

skabashnyuk Mar 31, 2020

vinokurig Mar 31, 2020

vinokurig Apr 1, 2020

che-bot commented Apr 1, 2020

che-bot commented Apr 2, 2020

che-bot commented Apr 3, 2020

che-bot commented Apr 8, 2020

vinokurig commented Apr 8, 2020

che-bot commented Apr 8, 2020

che-bot commented Apr 8, 2020

Apply web application that can make authentication requests with user token #16488

Apply web application that can make authentication requests with user token #16488

Conversation

vinokurig commented Mar 30, 2020 • edited Loading

What does this PR do?

What issues does this PR fix or reference?

Release Notes

Docs PR

che-bot commented Mar 30, 2020

che-bot commented Mar 31, 2020

skabashnyuk Mar 31, 2020

Choose a reason for hiding this comment

vinokurig Mar 31, 2020

Choose a reason for hiding this comment

vinokurig Apr 1, 2020

Choose a reason for hiding this comment

che-bot commented Apr 1, 2020

che-bot commented Apr 2, 2020

che-bot commented Apr 3, 2020

che-bot commented Apr 8, 2020

vinokurig commented Apr 8, 2020

che-bot commented Apr 8, 2020

che-bot commented Apr 8, 2020

vinokurig commented Mar 30, 2020 •

edited

Loading