GSoC 2022 Idea: CloudStack OAuth2 Plugin

[rohityadavcloud]

Background

Apache CloudStack currently support native, LDAP and SAML based authentication. The proposed idea is to write a new OAuth2 plugin which is UI-first and can perform Single-Sign-On (SSO) with 3-party identity providers such as Google, Facebook, Github etc and allows admins to manage the users/accounts.

Proposed Tasks

• Get started on basic CloudStack codebase and development (building and running CloudStack)
• Setup dev/test environment to test/develop authentication plugin w/OAuth2
• R&D - OAuth2 protocol and libraries that may be integrated with CloudStack
• Implement configuration: Global setting/options to enable/disable this plugin, specify the 3rd party providers (such as Google, Fb, Github etc) in both UI/backend
• Implement authentication plugin and mechanism
• Write tests and documentation, send pull request (with video/gif to demonstrate the feature)

Relevant Skills

• Java
• Javascript/Vue
• OAuth2

Difficulty

Medium

Potential Mentors

Nicolas Vazquez (nicovazquez90@gmail.com)
Rohit Yadav (rohit@apache.org)

Example and references

https://oauth.net/code/java/
https://spring.io/guides/tutorials/spring-boot-oauth2/
How to CloudStack Auth plugin: https://cwiki.apache.org/confluence/display/CLOUDSTACK/SAML+2.0+Plugin

[LeBW]

Hello, I'm a master's student at Fudan University, China. I'm interested in this project and I'd like to apply it for GSoC 2021. Is there any guidance or suggestions for me? Thank you!

[rohityadavcloud]

Hi @LeBW thanks for your interest.

I would advise that you read the community GSoC guidelines (https://community.apache.org/gsoc.html), join the dev mailing list (http://cloudstack.apache.org/mailing-lists.html) to discuss your GSoC idea/proposal/application, and start drafting your application (for example https://google.github.io/gsocguides/student/proposal-example-1). With your proposed mentor (see email above), start an early discussion with them and you can ask them to review your application draft (for example, compose your draft and share with a Google doc).

You can refer to the CloudStack course to help you draft your application and learn how to build something in CloudStack https://github.com/shapeblue/hackerbook

[nvazquez]

@LeBW hi, thanks for participating! Let us know if you need help with your application

[nvazquez]

Hi @LeBW if you are still interested in this project please submit your application by tomorrow

[LeBW]

Hi @LeBW if you are still interested in this project please submit your application by tomorrow

I'm sorry for the late reply. I have drafted my proposal and sent it to your email. Hope to receive your suggestions :).

Thanks!

[nvazquez]

Thanks @LeBW, I have recieved your draft proposal over email and added some comments. Please address them and submit your application through the GSOC portal https://summerofcode.withgoogle.com/ by Tuesday 13th 18:00 UTC (which is the deadline). My timezone is UTC-3, will be online if you need more assistance or ping @rhtyd who's timezone is closest to yours if I'm still not available

[khamarshaikh]

@nvazquez , @rohityadavcloud I wanted to check if this feature is still open , if yes I would like to contribute to it.

[rohityadavcloud]

Yes this is still open @khamarshaikh

[khamarshaikh]

@rohityadavcloud , I am interested to work on it, is there any standard process to get the issue assigned ? Also this year GSOC is open for all ( including working professionals) , I would like to begin and start contributing to the community.

[rohityadavcloud]

@borisstoyanov can you suggest/advise potential student @khamarshaikh

[khamarshaikh]

@borisstoyanov @rohityadavcloud I am trying to setup the development environment on mac OS , is there any documentation for it ? Currently I see only for CentOS

[rohityadavcloud]

Try https://github.com/shapeblue/hackerbook @khamarshaikh

[Damans227]

@rohityadavcloud @nvazquez Hi Guys, the GSoC 2022 proposal acceptance begins in April officially. Since, I am interested in working on this issue, can I create and a send a proposal for review now instead instead of waiting till April ?

[borisstoyanov]

Hi @Damans227, it's great to hear you have interest! You can start creating a reviewing the proposal and you can get in touch with community, mentor etc. Please be advised that the mentor could help you out, by means of good will, but the application and review of your proposal needs to go through the official process and timeline.

[Damans227]

Hi @Damans227, it's great to hear you have interest! You can start creating a reviewing the proposal and you can get in touch with community, mentor etc. Please be advised that the mentor could help you out, by means of good will, but the application and review of your proposal needs to go through the official process and timeline.

Understood, thanks for replying.

[Damans227]

@rohityadavcloud @nvazquez Just an FYI. I have shared a draft design document for this issue and am awaiting your feedback. Thanks!

[neogismm]

Hi folks, I'm interested in this idea and want to contribute to this project in gsoc being an open source beginner.

[neogismm]

As far as I understand, users have to be authorized/imported beforehand by an admin. If this is the case, I figured that OpenID connect (authentication protocol built on top of Oauth) has a state parameter which can connect partner IdPs (from LDAP or SAML) with OpenID providers such as Google to provide authentication.

[neogismm]

I also have a few questions:

1. What if someone tries to sign in who is not yet authorized by the admin (new user). Should the new user be granted access at all or should their role be set as a Read Only User or some different role?
2. What user data apart from: name, email, profile picture should be collected when the user authorizes access for cloudstack.

cc @rohityadavcloud @nvazquez @borisstoyanov

[nvazquez]

Hi @neogismm for the first stage we can assume that all users should be able to log in to CloudStack and are authorized. The role could be set as User (existing CloudStack role). About the second question, important fields should be username (which to try registering the user on CloudStack), first name, last name and email. The profile picture could be treated as a nice to have IMO

[nvazquez]

Hi @khamarshaikh @Damans227 @neogismm - I would like to remind you that the application starts on 4th April and closes 19th April. If you are still interested in this project, please submit your proposal within that timeframe

[Damans227]

Hi @khamarshaikh @Damans227 @neogismm - I would like to remind you that the application starts on 4th April and closes 19th April. If you are still interested in this project, please submit your proposal within that timeframe

Thanks for the reminder, @nvazquez I am eagerly waiting for April 4th.

[Damans227]

@nvazquez @rohityadavcloud @borisstoyanov Hi Guys, I hope you are doing well. I have submitted a project proposal for this issue today. PTAL when you get a chance. Thanks!

[borisstoyanov]

Thanks @Damans227, we'll have someone to look it up and get back to you if needed.

[neogismm]

@rohityadavcloud @nvazquez @borisstoyanov hi mentors, I've submitted my gsoc proposal. I've also emailed the Google docs link. Hope to hear from you soon.
Thanks.

[rohityadavcloud]

Closing the issue tracking, it seem there's a JIRA ticket too.
I see activity on PR #6524