Add OAuth support to generic host provider #1062

mjcheetham · 2023-01-27T23:55:20Z

Add ability to provide OAuth-based authentication for generic hosts by way of simple Git configuration.

When a remote URL does not match any known host provider plugin, the generic provider will now first check for OAuth configuration in the Git config or environment variables. If such config is available then we try and perform OAuth authentication. Support for device code flow is optional, and refresh tokens will be used if the service supports and returns them.

Users can make use of existing Git config include to easily organise and share custom OAuth configurations:

~/.gitconfig

[include]
    path = ~/.gcm/oauth/example.ini

example.ini

[credential "https://example.com"]
	provider = generic
	oauthClientId = <client-id>
	oauthClientSecret = <client-secret>
	oauthRedirectUri = <redirect-uri>
	oauthAuthorizeEndpoint = <auth-endpoint>
	oauthTokenEndpoint = <token-endpoint>
	oauthScopes = <scopes>
	oauthDeviceEndpoint = <device-endpoint>
	oauthDefaultUserName = <username>
	oauthUseClientAuthHeader = <true|false>

Fixes #1047

Fix a bug in a view model property for the basic credentials prompt; we should be updating the backing field and also raising the PropertyChanged event.

mjcheetham · 2023-01-30T18:29:40Z

src/shared/Core/GenericHostProvider.cs

+                Context.Trace,
+                config.UseAuthHeader);
+
+            string refreshService = remoteUri.AbsoluteUri.TrimEnd('/') + "/refresh_token";


I know there are some concerns about how we generate a service name for the refresh tokens with collisions with other credentials.

@hickford, you had suggested in the past using a subdomain to differentiate ATs and RTs:

https://foo.example.com/path/repo https://refresh_token.foo.example.com/path/repo

Did you or @ldennington have any other suggestions? I was going to change to the refresh_token subdomain example above if there was no objections.

I'm fine with the subdomain implementation.

mjcheetham · 2023-01-30T18:33:32Z

Right now there's no facility to 'test' an existing OAuth credential is valid, so we rely on the less-than-optimal flow of Git trying, failing, telling us to erase, and then expect the user to retry and then we'll use the refresh token.

In the future we may wish to allow a 'validity' endpoint to be configured where the generic implementation can make a GET request with the bearer token, and use the HTTP status code as a signal for validity (200 = OK, 401/403 => invalid).

ldennington

This is awesome!! 🚀

src/shared/Core/GenericOAuthConfig.cs

ldennington · 2023-01-30T22:37:57Z

src/shared/Core/GenericHostProvider.cs

@@ -128,6 +128,33 @@ private async Task<ICredential> GetOAuthAccessToken(Uri remoteUri, string userNa
                Context.Trace,
                config.UseAuthHeader);

+            //


Nit: Is this line needed?

I've used this pattern in other places in the code base to visually make a block of explanatory comments standout more.

src/shared/Git-Credential-Manager.UI.Avalonia/Views/OAuthView.axaml.cs

docs/generic-oauth.md

Teach the Generic host provider to read configuration for OAuth-based authentication. These are largely parameters required for the OAuth2Client to be constructed including Client ID/Secret, Redirect URI and Scopes.

Add OAuth support for the generic provider offering browser (authcode grant) and device code (device auth grant) support. Device code and mode selection is initially only offered for TTY users.

Add support for storing and using OAuth refresh tokens. Prepend "refresh_token" as a subdomain to give better chances of avoiding a name clash compared with appending "/refresh_token" to the path component.

Add shared view models and commands for the OAuth GUI prompts. Two new commands and VMs are added, one for the initial 'mode' selection, and another to display the device code.

Add AvaloniaUI based implementations of the OAuth and Device Code generic UI prompts.

Add the WPF based GUI implementation of the OAuth and device code generic prompts.

Add detection and use of GUI prompts for OAuth authentication.

ANGGBELPAS · 2023-04-11T13:09:32Z

Duplicate of #789

basic-ui: fix bug in VM property

e9ee764

Fix a bug in a view model property for the basic credentials prompt; we should be updating the backing field and also raising the PropertyChanged event.

mjcheetham requested a review from ldennington January 28, 2023 00:04

mjcheetham marked this pull request as ready for review January 28, 2023 00:04

mjcheetham force-pushed the generic-oauth branch 2 times, most recently from 567a0a8 to 36ad480 Compare January 28, 2023 00:55

mjcheetham commented Jan 30, 2023

View reviewed changes

mjcheetham requested a review from hickford January 30, 2023 18:53

mjcheetham force-pushed the generic-oauth branch from 36ad480 to d6521ba Compare January 30, 2023 19:19

ldennington approved these changes Jan 30, 2023

View reviewed changes

mjcheetham added 9 commits February 1, 2023 11:09

generic: add ability to read generic OAuth config

717b822

Teach the Generic host provider to read configuration for OAuth-based authentication. These are largely parameters required for the OAuth2Client to be constructed including Client ID/Secret, Redirect URI and Scopes.

generic: add OAuth support for browser & devicecode

720a078

Add OAuth support for the generic provider offering browser (authcode grant) and device code (device auth grant) support. Device code and mode selection is initially only offered for TTY users.

generic: add OAuth refresh token support

e323c83

Add support for storing and using OAuth refresh tokens. Prepend "refresh_token" as a subdomain to give better chances of avoiding a name clash compared with appending "/refresh_token" to the path component.

oauth-ui: Add shared VMs and commands for OAuth

6702935

Add shared view models and commands for the OAuth GUI prompts. Two new commands and VMs are added, one for the initial 'mode' selection, and another to display the device code.

generic-ui: add Avalonia impl of OAuth and Device Code

d59cd44

Add AvaloniaUI based implementations of the OAuth and Device Code generic UI prompts.

generic-ui: add WPF impl of OAuth and device code

241afed

Add the WPF based GUI implementation of the OAuth and device code generic prompts.

oauth: provide UI prompts for generic OAuth auth

8d2ace5

Add detection and use of GUI prompts for OAuth authentication.

docs: add generic OAuth documentation

1aeb9fc

generic: add OAuth test for generic provider

d8aa30b

mjcheetham force-pushed the generic-oauth branch from d6521ba to d8aa30b Compare February 1, 2023 19:09

mjcheetham merged commit 66b94e4 into git-ecosystem:main Feb 1, 2023

mjcheetham deleted the generic-oauth branch February 1, 2023 19:19

mjcheetham mentioned this pull request Feb 1, 2023

Support any OAuth server with custom config #1047

Closed

ldennington mentioned this pull request Feb 13, 2023

Add support for Gitea #145

Closed

mjcheetham mentioned this pull request Feb 22, 2023

Cut new release for Git 2.40 rc0 #1124

Merged

a1012112796 mentioned this pull request Jun 13, 2023

FR: Could gitea implement a feature like what Github did with git command line login? go-gitea/gitea#17934

Closed

bohni mentioned this pull request Jan 31, 2024

Gitea Oauth not working on Linux #1492

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OAuth support to generic host provider #1062

Add OAuth support to generic host provider #1062

mjcheetham commented Jan 27, 2023 •

edited

Loading

mjcheetham Jan 30, 2023

ldennington Jan 30, 2023

mjcheetham commented Jan 30, 2023

ldennington left a comment

ldennington Jan 30, 2023

mjcheetham Feb 1, 2023

ANGGBELPAS commented Apr 11, 2023

Add OAuth support to generic host provider #1062

Add OAuth support to generic host provider #1062

Conversation

mjcheetham commented Jan 27, 2023 • edited Loading

mjcheetham Jan 30, 2023

Choose a reason for hiding this comment

ldennington Jan 30, 2023

Choose a reason for hiding this comment

mjcheetham commented Jan 30, 2023

ldennington left a comment

Choose a reason for hiding this comment

ldennington Jan 30, 2023

Choose a reason for hiding this comment

mjcheetham Feb 1, 2023

Choose a reason for hiding this comment

ANGGBELPAS commented Apr 11, 2023

mjcheetham commented Jan 27, 2023 •

edited

Loading