Apply OpenShift OAuth provider #15963

vinokurig · 2020-02-07T14:27:00Z

What does this PR do?

Add OpenShift OAuth provider to be able to retrieve openshift token.

What issues does this PR fix or reference?

fixes #15670

Release Notes

Docs PR

che-bot · 2020-02-07T14:27:03Z

Can one of the admins verify this patch?

...he-core-api-auth-openshift/src/main/java/org/eclipse/che/security/oauth/OpenShiftModule.java

che-bot · 2020-02-07T14:50:47Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

che-bot · 2020-02-07T15:38:14Z

E2E tests of Eclipse Che Multiuser on OCP has been successful:

Build details
Test report
docker image: eclipseche/che-server:15963

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties

skabashnyuk · 2020-02-10T09:30:39Z

CC @tolusha
Do we need any changes in che-operator?

...he-core-api-auth-openshift/src/main/java/org/eclipse/che/security/oauth/OpenShiftModule.java

...auth-openshift/src/main/java/org/eclipse/che/security/oauth/OpenShiftOAuthAuthenticator.java

che-bot · 2020-02-10T09:42:54Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

che-bot · 2020-02-10T09:44:28Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

tolusha · 2020-02-10T10:07:03Z

@skabashnyuk
I hope @vinokurig will test changes with operator to figure that out.

che-bot · 2020-02-10T10:25:13Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:15963
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

che-bot · 2020-02-10T10:54:11Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties

che-bot · 2020-02-26T14:14:15Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Use command [ci-test] to rerun the test.

che-bot · 2020-02-26T14:55:34Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

davidfestal · 2020-02-26T15:57:56Z

I don't see any problems with OpenShift OAuth mode. The che OpenShift OAuth provider requires creating an own OpenShift OAuth client https://docs.openshift.com/container-platform/4.3/authentication/configuring-internal-oauth.html#oauth-register-additional-client_configuring-internal-oauth

Not sure I followed the whole story about this issue, but does this mean that now, by default, in order to have Openshift integration, users will have to manually create an additional OAuth client in Openshift in addition to the one already automatically created by the Che operator when Openshift OAuth is enabled (to support Keycloak-Openshift identity provider) ?

If it's the case I'm a bit worried about the fact that it might be a problem in some situations, such as deployment on OSD for example, where it would expected that any required change is done by the operator itself afaik, and no manual step is expected, apart the creation of a CheCluster custom resource.

In such a case I would suggest that, on the operator side, when OpenShift OAuth is enabled, the same OpenShift OAuth Client would be used to configure the Che server (of this PR) as the one already used for the Keycloak OpenShift identity provider.
So maybe there is still some work on the operator here.

cc @tolusha @l0rd

davidfestal

Please could you answer the question I asked here: #15963 (comment) ?

Thanks !

vinokurig · 2020-02-27T08:55:27Z

@davidfestal
We have similar situation with the GitHub oAuth provider, it requires creating the GitHub oAuth client on the GitHub side. We can automate creating the OpenShift oAuth client by the operator but it will mean that the OpenShift oAuth provider is supported only for operator installation.

davidfestal · 2020-02-27T13:27:54Z

@vinokurig

We have similar situation with the GitHub oAuth provider, it requires creating the GitHub oAuth client on the GitHub side.

GitHub is a bit different since, afaik, you cannot automate the creation of the GitHub OAuth client easily, and the GitHub OAuth client is somehow something expected to be owned by the Che admin user in a self-service mode.

OTOH setting up an OpenShift OAuth client requires cluster admin rights into the cluster, and the installer user of Che/CRW on OpenShift doesn't necessarily own the cluster on which it installs Che (think of OSD addon for example). So this should be done by the Che operator, and is already done to support Keycloak Openshift identity provider setup.

We can automate creating the OpenShift oAuth client by the operator but it will mean that the OpenShift oAuth provider is supported only for operator installation.

Afaik the operator-based installation is the official installation mode for OpenShift, either through chectl for OpenShift 3.11, or though OLM + OperatorHub for OpenShift 4.x (+ OSD, indirectly via addon).
Of course, for anyone having cluster admin rights, and wanting to use raw yaml files to deploy Che on OpenShift, he could still create the OAuth Client by hand by following the doc.

But it seems that requiring a manual setup of an additional OAuth client inside the OpenShift cluster before being able to use the OpenShift integration tools (OpenShift plugin ?) will be a no-go in a number of contexts we aim to support.

l0rd

After discussing with @vinokurig I consider that the user experience doesn't get worse with this PR. If we merge this PR Che will still use OpenShift OAuth as identity provider even if the administrator doesn't create the extra OpenShift OAuth client. But the administrator would have a new (manual) option to enable the OpenShift OAuth provider for the workspaces.

For this reason I consider it as a good first step and the PR can be merged as it is (and even cherry picked to 7.9.x if we have time cc @nickboldt). But as mentioned by @davidfestal there are some important improvements that need to be introduced (update the operator to automatically create the client for instance). Such improvements can be done in a second PR.

vinokurig · 2020-03-02T13:50:00Z

@l0rd @davidfestal Created sub-issue: #16199

vinokurig · 2020-03-03T08:01:50Z

crw-ci-test

vinokurig · 2020-03-03T08:02:13Z

[ci-test]

che-bot · 2020-03-03T08:07:35Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

che-bot · 2020-03-03T09:44:36Z

E2E tests of Eclipse Che Multiuser on OCP has been successful:

vinokurig · 2020-03-03T10:50:13Z

crw-ci-test

davidfestal · 2020-03-03T11:16:59Z

After discussing with @vinokurig I consider that the user experience doesn't get worse with this PR.

For this reason I consider it as a good first step and the PR can be merged as it is

Thanks @l0rd for providing more context.

Created sub-issue: #16199

Thanks @vinokurig

Let me approve this PR then.

vinokurig · 2020-03-03T12:33:18Z

crw-ci-test

che-bot · 2020-03-03T12:39:44Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

vinokurig · 2020-03-03T13:30:50Z

crw-ci-test

che-bot · 2020-03-03T13:36:34Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

dmytro-ndp · 2020-03-03T14:50:48Z

crw-ci-test

che-bot · 2020-03-03T15:00:56Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

dmytro-ndp · 2020-03-03T15:23:33Z

crw-ci-test

che-bot · 2020-03-03T16:14:08Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
logs and configs
Happy path tests DevFile
image: maxura/che-server:15963

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

Apply OpenShift OAuth provider

05bfe87

vinokurig requested review from ibuziuk, l0rd, nickboldt, rhopp, skabashnyuk, sleshchenko and vparfonov as code owners February 7, 2020 14:27

che-bot added kind/task Internal things, technical debt, and to-do tasks to be performed. status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. labels Feb 7, 2020

skabashnyuk reviewed Feb 7, 2020

View reviewed changes

...he-core-api-auth-openshift/src/main/java/org/eclipse/che/security/oauth/OpenShiftModule.java Outdated Show resolved Hide resolved

Merge branch 'master' of github.com:eclipse/che into che-15670

677161e

vinokurig force-pushed the che-15670 branch from b08d082 to 29d35ee Compare February 10, 2020 09:23

skabashnyuk reviewed Feb 10, 2020

View reviewed changes

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties Outdated Show resolved Hide resolved

skabashnyuk reviewed Feb 10, 2020

View reviewed changes

...he-core-api-auth-openshift/src/main/java/org/eclipse/che/security/oauth/OpenShiftModule.java Outdated Show resolved Hide resolved

skabashnyuk reviewed Feb 10, 2020

View reviewed changes

...auth-openshift/src/main/java/org/eclipse/che/security/oauth/OpenShiftOAuthAuthenticator.java Outdated Show resolved Hide resolved

skabashnyuk reviewed Feb 10, 2020

View reviewed changes

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties Outdated Show resolved Hide resolved

vinokurig requested review from ashumilova, benoitf and mshaposhnik as code owners February 10, 2020 11:06

vinokurig force-pushed the che-15670 branch from 9541526 to 677161e Compare February 10, 2020 11:12

davidfestal requested changes Feb 26, 2020

View reviewed changes

ericwill mentioned this pull request Feb 28, 2020

Che Plugins Sprint 180 #16083

Closed

21 tasks

l0rd approved these changes Mar 2, 2020

View reviewed changes

vinokurig mentioned this pull request Mar 2, 2020

Configure OpenShift oAuth client for the OpenShift oAuth provider by operator #16199

Closed

nickboldt mentioned this pull request Mar 2, 2020

Che 7.9.1 Release #16129

Closed

24 tasks

davidfestal approved these changes Mar 3, 2020

View reviewed changes

vinokurig merged commit cbaf94e into master Mar 4, 2020

vinokurig deleted the che-15670 branch March 4, 2020 08:49

che-bot added this to the 7.10.0 milestone Mar 4, 2020

che-bot removed the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Mar 4, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Apply OpenShift OAuth provider #15963

Apply OpenShift OAuth provider #15963

vinokurig commented Feb 7, 2020

che-bot commented Feb 7, 2020

che-bot commented Feb 7, 2020

che-bot commented Feb 7, 2020

skabashnyuk commented Feb 10, 2020

che-bot commented Feb 10, 2020

che-bot commented Feb 10, 2020

tolusha commented Feb 10, 2020

che-bot commented Feb 10, 2020

che-bot commented Feb 10, 2020

che-bot commented Feb 26, 2020

che-bot commented Feb 26, 2020

davidfestal commented Feb 26, 2020 •

edited

Loading

davidfestal left a comment

vinokurig commented Feb 27, 2020

davidfestal commented Feb 27, 2020

l0rd left a comment

vinokurig commented Mar 2, 2020

vinokurig commented Mar 3, 2020

vinokurig commented Mar 3, 2020

che-bot commented Mar 3, 2020

che-bot commented Mar 3, 2020

vinokurig commented Mar 3, 2020

davidfestal commented Mar 3, 2020

vinokurig commented Mar 3, 2020

che-bot commented Mar 3, 2020

vinokurig commented Mar 3, 2020

che-bot commented Mar 3, 2020

dmytro-ndp commented Mar 3, 2020

che-bot commented Mar 3, 2020

dmytro-ndp commented Mar 3, 2020

che-bot commented Mar 3, 2020

Apply OpenShift OAuth provider #15963

Apply OpenShift OAuth provider #15963

Conversation

vinokurig commented Feb 7, 2020

What does this PR do?

What issues does this PR fix or reference?

Release Notes

Docs PR

che-bot commented Feb 7, 2020

che-bot commented Feb 7, 2020

che-bot commented Feb 7, 2020

skabashnyuk commented Feb 10, 2020

che-bot commented Feb 10, 2020

che-bot commented Feb 10, 2020

tolusha commented Feb 10, 2020

che-bot commented Feb 10, 2020

che-bot commented Feb 10, 2020

che-bot commented Feb 26, 2020

che-bot commented Feb 26, 2020

davidfestal commented Feb 26, 2020 • edited Loading

davidfestal left a comment

Choose a reason for hiding this comment

vinokurig commented Feb 27, 2020

davidfestal commented Feb 27, 2020

l0rd left a comment

Choose a reason for hiding this comment

vinokurig commented Mar 2, 2020

vinokurig commented Mar 3, 2020

vinokurig commented Mar 3, 2020

che-bot commented Mar 3, 2020

che-bot commented Mar 3, 2020

vinokurig commented Mar 3, 2020

davidfestal commented Mar 3, 2020

vinokurig commented Mar 3, 2020

che-bot commented Mar 3, 2020

vinokurig commented Mar 3, 2020

che-bot commented Mar 3, 2020

dmytro-ndp commented Mar 3, 2020

che-bot commented Mar 3, 2020

dmytro-ndp commented Mar 3, 2020

che-bot commented Mar 3, 2020

davidfestal commented Feb 26, 2020 •

edited

Loading