Add support for local auth configuration #3632

kreinecke · 2019-06-05T09:36:28Z

Add an option in jetstream config to set up a user for local authentication as an alternative to remote auth. Will eventually remove the mandatory provisioning of a UAA.

cfdreddbot · 2019-06-05T09:36:30Z

✅ Hey kreinecke! The commit authors and yourself have already signed the CLA.

codecov · 2019-06-05T10:16:39Z

Codecov Report

Merging #3632 into v2-master will increase coverage by <.01%.
The diff coverage is 28.57%.

@@              Coverage Diff              @@
##           v2-master    #3632      +/-   ##
=============================================
+ Coverage      51.42%   51.43%   +<.01%     
=============================================
  Files            725      726       +1     
  Lines          20567    20569       +2     
  Branches        3682     3682              
=============================================
+ Hits           10577    10579       +2     
  Misses          9990     9990

kreinecke · 2019-06-07T09:49:54Z

NOTE default.config.properties should be excluded from merge until the corresponding front-end changes have been completed.

kreinecke · 2019-06-07T09:54:24Z

src/jetstream/default.config.properties

This file should be excluded from merge to disable this functionality until front-end changes are complete.

Do you want to comment out the values before we merge?

After other changes have been implemented and gates passed, will remove default config file from this PR entirely as this feature currently has no corresponding front end changes. Will update default config in the pending frontend change - feature will then be complete and config options fully usable.

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

…isterMigration call. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

…set in the config file Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

…enting a new auth endpoint type env var to select local or remote auth type. Modify local users table schema to make GUI and username unique, Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

…r. Add code to update last login time on login. Test for last login time update in progress. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

…remove info comments Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

… jetstream startup appropriately depending on whether local or remote auth is configured. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

…de Climate gate. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

…YPE not defined. Add auth_endpoint_type to console config DB table Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

nwmac

Just a few comments.

nwmac · 2019-06-17T12:52:04Z

src/jetstream/datastore/20190522121200_LocalUsers.go

+		createLocalUsers += "user_scope    VARCHAR(36), "
+		createLocalUsers += "last_login  TIMESTAMP, "
+		createLocalUsers += "last_updated  TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP);"
+		createLocalUsers += "CREATE TRIGGER update_last_updated AFTER UPDATE ON local_users BEGIN UPDATE local_users SET last_updated = DATETIME('now') WHERE _rowid_ = new._rowid_; END;"


Can we add a primary key to the table.

Also, does this CREATE TRIGGER syntax work with Postgres? Seems okay on SQLite and MySQL from what I can tell.

Thanks - it is indeed not valid for postgres - I will add alternative trigger definition for that case.

nwmac · 2019-06-17T12:53:16Z

src/jetstream/default.config.properties

Do you want to comment out the values before we merge?

nwmac · 2019-06-17T13:05:03Z

src/jetstream/main.go

@@ -773,6 +784,10 @@ func (p *portalProxy) registerRoutes(e *echo.Echo, addSetupMiddleware *setupMidd
 	pp.GET("/v1/auth/sso_login", p.initSSOlogin)
 	pp.GET("/v1/auth/sso_logout", p.ssoLogoutOfUAA)

+	// Local User login/logout
+	pp.POST("/v1/auth/local_login", p.localLogin)
+	pp.POST("/v1/auth/local_logout", p.logout)


Do you think the local routes and remote routes should check if the corresponding auth type matches and response with 404 ?

Yes. Will add.

nwmac · 2019-06-19T11:06:34Z

src/jetstream/datastore/20170818162837_SetupSchema.go

@@ -10,6 +10,7 @@ import (
 func init() {
 	RegisterMigration(20170818162837, "SetupSchema", func(txn *sql.Tx, conf *goose.DBConf) error {
 		consoleConfigTable := "CREATE TABLE IF NOT EXISTS console_config ("
+		consoleConfigTable += "  auth_endpoint_type        VARCHAR(255)              NOT NULL, "


We can't change a migration that has already been published - you'll need to move this to an ALTER statement in your new migration file.

Thanks. Done. Will push with remaining changes.

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

nwmac

Changes LGTM - will try it out

kreinecke · 2019-06-22T16:34:17Z

I will make a start on documenting the feature and config on a separate branch. That can be merged when the front end PR is complete. In the meantime if it's not clear when you try it out, let me know.

nwmac

LGTM

kreinecke force-pushed the local-admin-option branch 4 times, most recently from d6f056c to ad10abb Compare June 7, 2019 08:21

kreinecke commented Jun 7, 2019

View reviewed changes

kreinecke requested review from nwmac and removed request for nwmac June 7, 2019 13:00

kreinecke added 20 commits June 10, 2019 11:52

Add initial schema and login method skeletons

a4553fc

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Rename LocalUsers datastore with a unique ID. More code to auth.go

9b9b424

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Add last login field to users table. Add unique version string to Reg…

a304f05

…isterMigration call. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Added skeleton code for local users repo.

9323e4b

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Add function to find password hash, to local users repository

7b190bb

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Add function to add new local user, to local users repository

a70924c

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Add remainder of code for local user login. Fix build.

00cf310

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Code to initialise local users table on startup when a local user is …

8b54416

…set in the config file Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Fix incorrect field ordering on new user insert

8596a52

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Initial auth test function added to test local login

3f934c4

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Fix convey function ordering for several tests

b3c5582

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

More tests for local login error cases

e35345c

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Finish tests for adding local user. Finish config of remote/local use…

ab982d8

…r. Add code to update last login time on login. Test for last login time update in progress. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Finish auth login code and associated unit tests. Fix backend tests, …

7b83ce9

…remove info comments Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Tidy up and fix lint errors

caee9df

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Change name of env var for local user scope. Modify console output on…

9e385f5

… jetstream startup appropriately depending on whether local or remote auth is configured. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Refactor portalProxy.AddLocalUser and portalProxy.doLocalLogin for Co…

73e28fa

…de Climate gate. Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Fix code climate issues

c695fd3

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Add LocalUser struct to encapsulate attributes of a local user

f07878a

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

kreinecke added 3 commits June 10, 2019 11:52

Fix ungraceful jetstream crash during config setup if AUTH_ENDPOINT_T…

1870939

…YPE not defined. Add auth_endpoint_type to console config DB table Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Set auth endpoint to local for Travis build/review verification.

607221a

Fix skipping local user creation bug

a2d1606

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

kreinecke force-pushed the local-admin-option branch from 84fd2bc to a2d1606 Compare June 10, 2019 10:53

kreinecke added 3 commits June 10, 2019 12:27

Codeclimate fix

829294c

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

backend test fix

d558478

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

push default config for e2e tests

4b2d786

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

kreinecke force-pushed the local-admin-option branch from 54a7c7d to 7c0fda1 Compare June 10, 2019 17:19

Codeclimate fix

892fb95

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

kreinecke force-pushed the local-admin-option branch from 7c0fda1 to 892fb95 Compare June 10, 2019 17:24

kreinecke requested a review from nwmac June 11, 2019 07:13

nwmac assigned kreinecke Jun 12, 2019

nwmac added ready for review conflicts Merge conflicts on PR labels Jun 12, 2019

Resolve conflicts

3fb9d71

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

nwmac removed the conflicts Merge conflicts on PR label Jun 17, 2019

nwmac suggested changes Jun 17, 2019

View reviewed changes

nwmac removed the ready for review label Jun 18, 2019

nwmac reviewed Jun 19, 2019

View reviewed changes

kreinecke added 2 commits June 20, 2019 18:22

Complete PR changes. Revert all PR changes to default.config.properties

92a4bfa

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

Codeclimate fix to DB migration

5f0709d

Signed-off-by: Kate E. Reinecke <50168367+kreinecke@users.noreply.github.com>

kreinecke added the ready for review label Jun 21, 2019

kreinecke requested a review from nwmac June 21, 2019 08:55

nwmac reviewed Jun 21, 2019

View reviewed changes

nwmac added 2 commits July 4, 2019 16:45

Fix potential upgrade case where config is null

0280f2d

Tweak column sized for email, name and scope

9504696

nwmac approved these changes Jul 5, 2019

View reviewed changes

nwmac merged commit 26c3b78 into v2-master Jul 6, 2019

nwmac deleted the local-admin-option branch July 6, 2019 09:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for local auth configuration #3632

Add support for local auth configuration #3632

kreinecke commented Jun 5, 2019

cfdreddbot commented Jun 5, 2019

codecov bot commented Jun 5, 2019 •

edited

Loading

kreinecke commented Jun 7, 2019

kreinecke Jun 7, 2019

nwmac Jun 17, 2019

kreinecke Jun 17, 2019

nwmac left a comment

nwmac Jun 17, 2019

kreinecke Jun 17, 2019

nwmac Jun 17, 2019

nwmac Jun 17, 2019

kreinecke Jun 17, 2019

nwmac Jun 19, 2019

kreinecke Jun 19, 2019

nwmac left a comment

kreinecke commented Jun 22, 2019

nwmac left a comment

Add support for local auth configuration #3632

Add support for local auth configuration #3632

Conversation

kreinecke commented Jun 5, 2019

cfdreddbot commented Jun 5, 2019

codecov bot commented Jun 5, 2019 • edited Loading

Codecov Report

kreinecke commented Jun 7, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nwmac left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nwmac left a comment

Choose a reason for hiding this comment

kreinecke commented Jun 22, 2019

nwmac left a comment

Choose a reason for hiding this comment

codecov bot commented Jun 5, 2019 •

edited

Loading