Skip to content

Console OIDC generate token#35609

Merged
leedqin merged 1 commit intoMaterializeInc:mainfrom
leedqin:console-oidc-generate-token
Apr 2, 2026
Merged

Console OIDC generate token#35609
leedqin merged 1 commit intoMaterializeInc:mainfrom
leedqin:console-oidc-generate-token

Conversation

@leedqin
Copy link
Copy Markdown
Contributor

@leedqin leedqin commented Mar 24, 2026

Motivation

This is a stacked PR for OIDC login PR: #35440
This PR let's the user retrieve the ID token for psql connection string

Changes that would go in are from the last commit

Description

  • Added OIDC Connection modal similar to Connect modal for cloud console to show the connection instructions and ID token
image

Verification

Once logged in using SSO, take the connection string and put that in the terminal. You will be prompted to put in a password so copy and paste the id token to get authenticated

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 24, 2026

Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone.

PR title guidelines

  • Use imperative mood: "Fix X" not "Fixed X" or "Fixes X"
  • Be specific: "Fix panic in catalog sync when controller restarts" not "Fix bug" or "Update catalog code"
  • Prefix with area if helpful: compute: , storage: , adapter: , sql:

Pre-merge checklist

  • The PR title is descriptive and will make sense in the git log.
  • This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
  • If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.
  • This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
  • If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
  • If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).

@leedqin leedqin marked this pull request as ready for review March 24, 2026 18:12
@leedqin leedqin requested a review from a team as a code owner March 24, 2026 18:12
@leedqin leedqin requested review from SangJunBak and removed request for a team March 24, 2026 18:12
@leedqin leedqin force-pushed the console-oidc-generate-token branch from 40a42d6 to 97a881b Compare March 24, 2026 19:28
SangJunBak
SangJunBak requested changes Mar 25, 2026
View reviewed changes
console/src/components/OidcConnectModal.tsx Outdated
return (claims.email as string) ?? (claims.sub as string) ?? "";
}, [idToken]);

const obfuscated = idToken ? "*".repeat(Math.min(idToken.length, 40)) : "";
Copy link
Copy Markdown
Contributor

@SangJunBak SangJunBak Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Maybe we can reuse the obfuscate code in formatAppPassword?

console/src/components/OidcConnectModal.tsx Outdated
Comment on lines +47 to +48
const claims = decodeJwtPayload(idToken);
return (claims.email as string) ?? (claims.sub as string) ?? "";
Copy link
Copy Markdown
Contributor

@SangJunBak SangJunBak Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So we don't actually know if these claims represent the authentication claim. Ultimately it's controlled by the system variable OIDC_AUTHENTICATION_CLAIM. I'd maybe just add a placeholder here in the UI

console/src/layouts/NavBar/NavMenu.tsx Outdated
Comment on lines +312 to +313
apiClient.type === "self-managed" &&
apiClient.oidcManager?.getIdToken() ? (
Copy link
Copy Markdown
Contributor

@SangJunBak SangJunBak Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps appConfig.authMode is enough given we use useAuth later on anyways? Same for the navbar in NavBar.tsx.

Also should we be concerned about the token returned from getIdToken (since it's cached) vs. the token returned from useAuth?

Copy link
Copy Markdown
Contributor Author

@leedqin leedqin Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep! overlooked this change from the last PR refactors but addressed this in the latest commit

@leedqin leedqin force-pushed the console-oidc-generate-token branch from 97a881b to 0127d7f Compare March 31, 2026 18:57
@leedqin leedqin requested a review from SangJunBak March 31, 2026 18:57
@leedqin
OIDC Connect Modal with Id token
6ed05ac 
-  Similar to connect modal in the cloud, oidc connect modal let's the user authenticate for a pgwire connection using the id token

PR feedback:
- moved password obfuscation to a shared utility to be used for OIDC modal and frontegg modal
- Removed check for appclient.type === "self-managed"
- Retrieving token value from useAuth().user.idtoken
@leedqin leedqin force-pushed the console-oidc-generate-token branch from 0127d7f to 6ed05ac Compare April 2, 2026 19:13
@leedqin leedqin enabled auto-merge (squash) April 2, 2026 19:14
@leedqin leedqin merged commit 02459d5 into MaterializeInc:main Apr 2, 2026
110 checks passed
jasonhernandez pushed a commit to jasonhernandez/materialize that referenced this pull request Apr 2, 2026
@leedqin @jasonhernandez
Console OIDC generate token (MaterializeInc#35609)
2ecf488 
### Motivation

This is a stacked PR for OIDC login PR:
MaterializeInc#35440
This PR let's the user retrieve the ID token for psql connection string

Changes that would go in are from the last commit 

### Description

- Added OIDC Connection modal similar to Connect modal for cloud console
to show the connection instructions and ID token

<img width="2680" height="1598" alt="image"
src="https://github.com/user-attachments/assets/494b2949-827f-489d-afd9-6ca86bf890b5"
/>



### Verification
Once logged in using SSO, take the connection string and put that in the
terminal. You will be prompted to put in a password so copy and paste
the id token to get authenticated
jasonhernandez pushed a commit to jasonhernandez/materialize that referenced this pull request Apr 2, 2026
@leedqin @jasonhernandez
Console OIDC generate token (MaterializeInc#35609)
dcf2a2d 
### Motivation

This is a stacked PR for OIDC login PR:
MaterializeInc#35440
This PR let's the user retrieve the ID token for psql connection string

Changes that would go in are from the last commit 

### Description

- Added OIDC Connection modal similar to Connect modal for cloud console
to show the connection instructions and ID token

<img width="2680" height="1598" alt="image"
src="https://github.com/user-attachments/assets/494b2949-827f-489d-afd9-6ca86bf890b5"
/>



### Verification
Once logged in using SSO, take the connection string and put that in the
terminal. You will be prompted to put in a password so copy and paste
the id token to get authenticated
jasonhernandez pushed a commit to jasonhernandez/materialize that referenced this pull request Apr 2, 2026
@leedqin @jasonhernandez
Console OIDC generate token (MaterializeInc#35609)
3849278 
### Motivation

This is a stacked PR for OIDC login PR:
MaterializeInc#35440
This PR let's the user retrieve the ID token for psql connection string

Changes that would go in are from the last commit 

### Description

- Added OIDC Connection modal similar to Connect modal for cloud console
to show the connection instructions and ID token

<img width="2680" height="1598" alt="image"
src="https://github.com/user-attachments/assets/494b2949-827f-489d-afd9-6ca86bf890b5"
/>



### Verification
Once logged in using SSO, take the connection string and put that in the
terminal. You will be prompted to put in a password so copy and paste
the id token to get authenticated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SangJunBak SangJunBak SangJunBak approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@leedqin @SangJunBak