Initial version of OAuth server to manage access to Gitpod workspaces #4222

rl-gitpod · 2021-05-17T09:21:37Z

No description provided.

rl-gitpod · 2021-05-17T22:24:08Z

What does this PR do?

Adds an OAuth2 server endpoints (behind a feature flag) to enable standard OAuth2 clients to interact with Gitpod and be granted access to a users workspaces
Specifically, it utilises PKCE (Proof Key for Code Exchange) to reduce the potential for MITM attacks to gain access to tokens
Exposes /api/oauth/authorization and /api/oauth/token for the client flow to use along with /oauth-approval for the access approval form:
- /api/oauth/authorization
  - will open a browser and redirect to the standard Gitpod provider login (Github, Gitlab, etc) if not logged in (opening a browser works in Linux (requires xdg-open)/OSX/Windows
  - will open a browser and ask user to grant permission for the OAuth2 client to access their workspaces if not already done so
  - opened tabs are automatically closed
- /api/oauth/token if given correct authenticaion code and PKCE params will return a Gitpod token in standard OAuth2 format:

{
  "access_token": "eyJhb...",
  "expires_in": 86400,
  "refresh_token": "eyJhb...",
  "scope": "function:getWorkspace, etc",
  "token_type": "Bearer"
}

* /oauth-approval displays the request for client access approval or not (needs tidying up)

Extends the existing login code to add support for the required redirection - currently limited only to the new endpoints on the same server
Connects the OAuth2 server into the db, reusing the GitpodToken table as the token repository, adding a table for the temporary auth code (needs to be periodically emptied)
Adds a hacky way to test this to the existing client
Adds some initial documentation on how to add tables, etc to gitpod-db via TypeORM

What this PR does not do?

Add the new OAuth2 flow to the existing client (next up)

Testing

Installing local app

Login: https://rl-gplctl-oauth-server.staging.gitpod-dev.com/workspaces/
Open this branch in Gitpod: https://gitpod.io/#https://github.com/gitpod-io/gitpod/pull/4222
Run leeway build --serve=:8080 components/local-app:app-darwin in terminal to build local-app for Mac
for linux or windows use another suffix
Open port 8080 in another tab and download local-app
Grant permissions to execute the app (e.g. Ctrl+Click - Open on OSX)
chmod +x to make it executable
Run GITPOD_HOST=https://rl-gplctl-oauth-server.staging.gitpod-dev.com ./local-app test
It will open the standard login screen if you are not already logged in:
If you haven't granted access to your workspaces to the client it will ask:
Clicking 'No' will close down the local-app immediately
Clicking 'Yes' will proceed with the retrieval of the OAuth2 token

rl-gitpod · 2021-05-17T22:54:34Z

/werft run

👍 started the job as gitpod-build-rl-gplctl-oauth-server.2

rl-gitpod · 2021-05-18T05:58:23Z

/werft run

👍 started the job as gitpod-build-rl-gplctl-oauth-server.3

components/dashboard/src/App.tsx

svenefftinge · 2021-05-18T07:44:48Z

@gtsiolis can you help with the design of this page?

components/dashboard/src/Login.tsx

gtsiolis · 2021-05-18T09:34:52Z

@gtsiolis can you help with the design of this page?

@svenefftinge Yes! Although not needed, how could I see this page in aciton? I'd like to also see the interaction for this (if the tab is closing, etc). I tried following the steps in #4222 (comment) but only see the following then opening port 8080. /cc @rl-gitpod

rl-gitpod · 2021-05-18T09:49:21Z

@gtsiolis can you help with the design of this page?

@svenefftinge Yes! Although not needed, how could I see this page in aciton? I'd like to also see the interaction for this (if the tab is closing, etc). I tried following the steps in #4222 (comment) but only see the following then opening port 8080. /cc @rl-gitpod

You need to download the local-app in that screen and keep on with the directions.
I'll record a loom which should help.

rl-gitpod · 2021-05-18T09:52:56Z

@gtsiolis https://www.loom.com/share/9442ca1e2ab6408c93ce8c3390cf20e4

Note that the gitpod.io page is only there to keep chrome on the screen during the recording, it plays no part.

csweichel

Other than the generous display of logging statements the code LGTM. I've gone through the testing instructions and things work as advertised. Pending @gtsiolis's comments this could land in main I reckon :)

components/gitpod-db/src/typeorm/auth-code-repository-db.ts

components/gitpod-db/src/typeorm/user-db-impl.ts

components/gitpod-protocol/src/protocol.ts

components/server/src/oauth-server/oauth-controller.ts

gtsiolis · 2021-05-18T13:34:47Z

Note that the gitpod.io page is only there to keep chrome on the screen during the recording ...

Thanks for clarifying @rl-gitpod!

Here're two variations we could use in case one of these two makes more sense, following two relevant existing designs in the product. Feel free to adjust text per need. A couple of notes or things to consider:

Since this action is associated with an account, including the account avatar can help the user understand which kind of data will be exposed with this authorization.
If possible, we could include the workspace name (friendly identifier) in the message body. We limit the scope of this authorization to a specific workspace, right?
Title message could also read Authorize Gitpod App, Authorize Gitpod CLI, etc.
The first design proposal follows the specs from the Install GitHub App flow, see Install in Implement /install-github-app flow #3702.
The second design proposal follows the modal component as used in the workspace start page when reaching a limit, see Parallel Workspaces [Dashboard] Workspace Start Page #3301.
If both seem appropriate, let's go with Proposal A. Otherwise, I'll defer this to @svenefftinge.
If useful, we could provide useful a link to the dashboard instead of cancelling the action. Cancel action is probably more appropriate.
If these style changes can land into the same milestone, it should be fine to leave these out of the scope of this PR and open a new PR instead. 🛹

Proposal A (Full Page)	Proposal B (Modal)

See also relevant specs and relevant existing implementations in #3704 and #3693.

components/server/tsconfig.json

AlexTugarev · 2021-05-19T06:13:57Z

yarn.lock

  version "5.0.1"
  resolved "https://registry.yarnpkg.com/vscode-jsonrpc/-/vscode-jsonrpc-5.0.1.tgz#9bab9c330d89f43fc8c1e8702b5c36e058a01794"
  integrity sha512-JvONPptw3GAQGXlVV2utDcHx0BiY34FupW/kI6mZ5x06ER5DdPG/tXWMVHjTNULF5uKPOUUD0SaXg5QaubJL0A==

+vscode-languageserver-protocol@3.15.3:


surprising!

components/server/src/oauth-server/oauth-controller.ts

components/dashboard/src/OauthClientApproval.tsx

AlexTugarev · 2021-05-19T07:19:17Z

components/gitpod-db/src/typeorm/auth-code-repository-db.ts

+    public issueAuthCode(client: OAuthClient, user: OAuthUser | undefined, scopes: OAuthScope[]): OAuthAuthCode {
+        const code = crypto.randomBytes(30).toString('hex');
+        log.info(`issueAuthCode: ${JSON.stringify(client)}, ${JSON.stringify(user)}, ${JSON.stringify(scopes)}, ${code}`);
+        // NOTE: caller (@jmondi/oauth2-server) is responsible for adding the remaining items, PKCE params, redirect URL, etc


on #4164 (comment)

given, that this is called by the oauth2 server framework, I'd suggest to extract and move it to the server component. it seems odd to implement the missing bits for the framework within gitpod-db.

That requires moving the entire AuthCodeRepositoryDB (OAuthAuthCodeRepository) implementation to server and since it requires storage, then adding a db service + implementation for it to use.

I agree it meets the current, very structured implementation approach for most parts of the system that interact with the db and will take a look at it tomorrow.

That requires moving the entire AuthCodeRepositoryDB (OAuthAuthCodeRepository) implementation to server

no it doesn't.

this pattern is used in may cases here. the DB implementation lives in gitpod-db and is injected into services from server.

odd to implement the missing bits for the framework within gitpod-db.

Not so much a missing bit but the OAuthAuthCodeRepository interface needs to be implemented for the framework to use. Moving 1 requires moving the rest (yes - there are other, less readable ways to do so).

this pattern is used in may cases here. the DB implementation lives in gitpod-db and is injected into services from server.

Agreed. That's what I was referring to with "then adding a db service + implementation for it to use"

components/dashboard/src/OauthClientApproval.tsx

components/server/src/oauth-server/oauth-authorization-server.ts

rl-gitpod · 2021-05-19T08:15:33Z

Thanks @gtsiolis!

Since this action is associated with an account, including the account avatar can help the user understand which kind of data will be exposed with this authorization.

What we are doing here is the same as the 'Consent form' for any/all OAuth implementations e.g. here or here
They tend to be more modal in nature, but not always.

Ultimately we will want to itemise the types of access (scopes) they are approving, but we don't have a good sense of what they should be at this point so we are asking for a general access approval.

If possible, we could include the workspace name (friendly identifier) in the message body. We limit the scope of this authorization to a specific workspace, right?

It is for all workspaces atm. That will likely change in the future, but not for the first iteration and possibly more.

If both seem appropriate, let's go with Proposal A. Otherwise, I'll defer this to @svenefftinge.

The 'Consent form' in other systems tends to be modal. It is also simpler to implement :-)

If it is not modal, having the ability to jump to the dashboard/account/etc without completing an action would need to be handled. If we assume that it doesn't mean either yes or no (and therefore we don't need to update the db to reflect that) it could just be a timeout i.e. easy.

If these style changes can land into the same milestone, it should be fine to leave these out of the scope of this PR and open a new PR instead. 🛹

If we have a decision on A vs B, I'll take a look tomorrow.

rl-gitpod · 2021-05-20T01:17:44Z

/werft run

👍 started the job as gitpod-build-rl-gplctl-oauth-server.10

rl-gitpod · 2021-05-21T02:07:55Z

/werft run

👍 started the job as gitpod-build-rl-gplctl-oauth-server.16

rl-gitpod · 2021-05-21T02:29:37Z

/werft run

👍 started the job as gitpod-build-rl-gplctl-oauth-server.17

csweichel

Got this when trying to authenticate:

components/server/src/oauth-server/oauth-controller.ts

rl-gitpod · 2021-05-21T07:08:46Z

Got this when trying to authenticate:

Ah, a little chicken/egg :-(

That scope is valid but insufficient (only a single workspace) so it was changed to 'getWorkspaces' in the backend.

You need to build a local app using the commit I linked to in our discussion

csweichel

There's still a bunch of log statements which I'd fret would be too loud in production. Many (most?) of them should either be on debug level, or be removed.

Other than that, after some commit history authoring this change would be ready for main.

Thank you very much for adding this! OAuth in Gitpod enables a whole host of new use-cases.

components/server/src/user/user-controller.ts

components/gitpod-db/src/typeorm/user-db-impl.ts

to manage client application access to users Gitpod workspaces

csweichel

LGTM

…io#4222) to manage client application access to users Gitpod workspaces

rl-gitpod marked this pull request as ready for review May 17, 2021 23:13

rl-gitpod self-assigned this May 17, 2021

rl-gitpod requested a review from akosyakov May 18, 2021 05:58

rl-gitpod requested a review from csweichel May 18, 2021 05:58

svenefftinge reviewed May 18, 2021

View reviewed changes

components/dashboard/src/App.tsx Show resolved Hide resolved

svenefftinge requested a review from AlexTugarev May 18, 2021 07:46

svenefftinge reviewed May 18, 2021

View reviewed changes

components/dashboard/src/Login.tsx Outdated Show resolved Hide resolved

csweichel reviewed May 18, 2021

View reviewed changes

rl-gitpod mentioned this pull request May 19, 2021

Add full OAuth2 server for gitpod local control to use #4164

Closed

AlexTugarev reviewed May 19, 2021

View reviewed changes

rl-gitpod force-pushed the rl/gplctl-oauth-server branch from 9288d08 to 25a6e47 Compare May 20, 2021 01:30

csweichel reviewed May 21, 2021

View reviewed changes

components/server/src/oauth-server/oauth-controller.ts Outdated Show resolved Hide resolved

csweichel reviewed May 21, 2021

View reviewed changes

[server] add OAuth2 server endpoints (behind a feature flag)

8de1006

to manage client application access to users Gitpod workspaces

rl-gitpod force-pushed the rl/gplctl-oauth-server branch from b7b4a5d to 8de1006 Compare May 21, 2021 10:29

csweichel approved these changes May 21, 2021

View reviewed changes

rl-gitpod merged commit f96392a into main May 21, 2021

rl-gitpod deleted the rl/gplctl-oauth-server branch May 21, 2021 11:23

MatthewFagan pushed a commit to trilogy-group/gitpod that referenced this pull request Nov 17, 2021

[server] add OAuth2 server endpoints (behind a feature flag) (gitpod-…

f4270fd

…io#4222) to manage client application access to users Gitpod workspaces

MatthewFagan pushed a commit to trilogy-group/gitpod that referenced this pull request Nov 18, 2021

[server] add OAuth2 server endpoints (behind a feature flag) (gitpod-…

fe8b0a8

…io#4222) to manage client application access to users Gitpod workspaces

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Initial version of OAuth server to manage access to Gitpod workspaces #4222

Initial version of OAuth server to manage access to Gitpod workspaces #4222

rl-gitpod commented May 17, 2021

rl-gitpod commented May 17, 2021 •

edited

Loading

rl-gitpod commented May 17, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 18, 2021 •

edited by werft-gitpod-dev-com bot

Loading

svenefftinge commented May 18, 2021

gtsiolis commented May 18, 2021 •

edited

Loading

rl-gitpod commented May 18, 2021

rl-gitpod commented May 18, 2021 •

edited

Loading

csweichel left a comment

gtsiolis commented May 18, 2021 •

edited

Loading

AlexTugarev May 19, 2021

AlexTugarev May 19, 2021

rl-gitpod May 19, 2021

AlexTugarev May 19, 2021

rl-gitpod May 19, 2021

rl-gitpod commented May 19, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 20, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 21, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 21, 2021 •

edited by werft-gitpod-dev-com bot

Loading

csweichel left a comment

rl-gitpod commented May 21, 2021

csweichel left a comment

csweichel left a comment

Initial version of OAuth server to manage access to Gitpod workspaces #4222

Initial version of OAuth server to manage access to Gitpod workspaces #4222

Conversation

rl-gitpod commented May 17, 2021

rl-gitpod commented May 17, 2021 • edited Loading

What does this PR do?

What this PR does not do?

Testing

Installing local app

rl-gitpod commented May 17, 2021 • edited by werft-gitpod-dev-com bot Loading

rl-gitpod commented May 18, 2021 • edited by werft-gitpod-dev-com bot Loading

svenefftinge commented May 18, 2021

gtsiolis commented May 18, 2021 • edited Loading

rl-gitpod commented May 18, 2021

rl-gitpod commented May 18, 2021 • edited Loading

csweichel left a comment

Choose a reason for hiding this comment

gtsiolis commented May 18, 2021 • edited Loading

AlexTugarev May 19, 2021

Choose a reason for hiding this comment

AlexTugarev May 19, 2021

Choose a reason for hiding this comment

rl-gitpod May 19, 2021

Choose a reason for hiding this comment

AlexTugarev May 19, 2021

Choose a reason for hiding this comment

rl-gitpod May 19, 2021

Choose a reason for hiding this comment

rl-gitpod commented May 19, 2021 • edited by werft-gitpod-dev-com bot Loading

rl-gitpod commented May 20, 2021 • edited by werft-gitpod-dev-com bot Loading

rl-gitpod commented May 21, 2021 • edited by werft-gitpod-dev-com bot Loading

rl-gitpod commented May 21, 2021 • edited by werft-gitpod-dev-com bot Loading

csweichel left a comment

Choose a reason for hiding this comment

rl-gitpod commented May 21, 2021

csweichel left a comment

Choose a reason for hiding this comment

csweichel left a comment

Choose a reason for hiding this comment

rl-gitpod commented May 17, 2021 •

edited

Loading

rl-gitpod commented May 17, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 18, 2021 •

edited by werft-gitpod-dev-com bot

Loading

gtsiolis commented May 18, 2021 •

edited

Loading

rl-gitpod commented May 18, 2021 •

edited

Loading

gtsiolis commented May 18, 2021 •

edited

Loading

rl-gitpod commented May 19, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 20, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 21, 2021 •

edited by werft-gitpod-dev-com bot

Loading

rl-gitpod commented May 21, 2021 •

edited by werft-gitpod-dev-com bot

Loading