Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sync concourse/dex with upstream Dex #4983

Open
xtremerui opened this issue Jan 8, 2020 · 5 comments
Open

Sync concourse/dex with upstream Dex #4983

xtremerui opened this issue Jan 8, 2020 · 5 comments
Labels
auth dependencies enhancement epic
Projects
Roadmap

Comments

@xtremerui
Copy link
Contributor

The goal is to adopt changes from https://github.com/dexidp/dex as much as possible.

Meanwhile we could re-visit PRs in our fork to make sure they are not obslete.
@xtremerui
Copy link
Contributor Author

xtremerui commented Jan 8, 2020 •
edited

Notice concourse/dex@5d302f2 in pr/oidc-groups-and-tls is covered by conflicted with dexidp/dex@8c1716d

@jwntrs
Copy link
Contributor

jwntrs commented Jan 8, 2020 •
edited

I believe those two actually target two different claims.

dexidp/dex@8c1716d is the name claim.
concourse/dex@5d302f2 is the username claim.

The name claim is meant to be something like Josh Winters, whereas the username claim is meant to be jwinters.

It's complicated by the fact that upstream dex doesn't have the username claim at all. They implemented preferred_username so that's good at least.

I guess to make concourse/dex@5d302f2 compatible with upstream we need to change it to be PreferredUsernameKey.

@jwntrs
Copy link
Contributor

jwntrs commented Jan 8, 2020

Before we do all this work I think the main starting point would be to get upstream dex to support the client_credentials and password grant types. Because until they do that we'll never be able to switch off our fork.

@xtremerui xtremerui self-assigned this Jan 8, 2020
jwntrs pushed a commit that referenced this issue Jan 9, 2020
dex: bump dex
b6e65ec 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
jwntrs pushed a commit that referenced this issue Jan 9, 2020
dex: bump dex
f465e2e 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
@xtremerui
Copy link
Contributor Author

xtremerui commented Jan 13, 2020 •
edited

jwntrs pushed a commit that referenced this issue Jan 27, 2020
dex: bump dex
25edec4 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
jwntrs pushed a commit that referenced this issue Feb 3, 2020
dex: bump dex
fe0f1df 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
@vito vito added the paused label Feb 10, 2020
jwntrs pushed a commit that referenced this issue Feb 13, 2020
dex: bump dex
33c5bbe 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
@vito vito mentioned this issue Feb 18, 2020
Closed
@vito vito removed the paused label Feb 18, 2020
@vito vito mentioned this issue Feb 19, 2020
Merged
jwntrs pushed a commit that referenced this issue Feb 21, 2020
dex: bump dex
f36e250 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
jwntrs pushed a commit that referenced this issue Feb 28, 2020
dex: bump dex
1221268 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
xtremerui pushed a commit that referenced this issue Mar 2, 2020
dex: bump dex
090bbc3 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
jwntrs pushed a commit that referenced this issue Mar 20, 2020
dex: bump dex
61c7e97 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
jwntrs pushed a commit that referenced this issue Mar 26, 2020
dex: bump dex
c3d2431 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
jwntrs pushed a commit that referenced this issue Mar 31, 2020
dex: bump dex
2685bd0 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
jwntrs pushed a commit that referenced this issue Apr 6, 2020
dex: bump dex
69cf92d 
- this points dex to a branch with two new commits:

  1) it adds the client credentials grant type

  2) adds the ability to configure dex with a static token signing key
  for backwards compatibility with current concourse deployments.

- after #4983 we can point
to that new branch

Signed-off-by: Josh Winters <jwinters@pivotal.io>
@xtremerui xtremerui mentioned this issue Apr 20, 2020
Merged
@vito vito added this to To do in Roadmap via automation May 8, 2020
@vito vito moved this from To do to Icebox in Roadmap May 8, 2020
@xtremerui xtremerui mentioned this issue Oct 6, 2020
Closed
@xtremerui xtremerui mentioned this issue Oct 6, 2020
Closed
@xtremerui xtremerui added this to the v7.7.0 milestone Nov 10, 2021
@xtremerui
Copy link
Contributor Author

xtremerui commented Nov 10, 2021 •
edited

Regarding the fact that certain PRs will not be merged into upstream Dex in near future, we need to prepare a plan for switching back to upstream dex WITH deprecating some features in current Concourse. i.e. PRs remaining:

  • oauth connector merged
  • cloudfoundry connector
  • tls config for oidc connector
  • client credential grant type (for tsa registering worker)

we will need to investigate the impact of losing some of above feature. If the impact is low, we will be targeting the switching on Jan 2021. If the impact is high, our fork concourse/dex will be frozen in all concourse releases in the future.

The ultimate goal is to reduce the maintenance effort needed for keeping dex up-to-date.

@navdeep-pama navdeep-pama removed this from the v7.7.0 milestone Feb 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
auth dependencies enhancement epic
Projects
Roadmap
  
Icebox
Milestone
No milestone
Development

No branches or pull requests
5 participants
@vito @jwntrs @xtremerui @navdeep-pama @jamieklassen