[auth] Implement device flow auth #1114

mikeland73 · 2023-06-07T06:39:44Z

Summary

This adds a new hidden top level command devbox auth. It adds a few other commands:

devbox auth login
devbox auth logout
devbox auth refresh
devbox auth whoami

This infrastructure will be used to power devbox global push/pull. It is customizable so that a user could specify own auth0 tenant.

How was it tested?

Changed refresh token expiration to be 5 seconds so I could test out auto-refresh.

devbox auth login
devbox auth logout
devbox auth refresh
devbox auth whoami

loreto · 2023-06-08T14:39:33Z

Questions on the UX and not the implementation:

Do we need refresh? Seems like an implementation detail that we shouldn't expose to users.
I don't remember: but are the login flows and signup flows the same? If not, would it be worth it to also have devbox auth signup

mikeland73 · 2023-06-08T19:06:54Z

refresh is only for debugging. Trying to retrieve the user does refresh automatically.

login does both login and registration. This is easiest approach.

LucilleH · 2023-06-08T22:38:52Z

internal/auth/authenticator.go

+		),
+		Domain: envir.GetValueOrDefault(
+			"DEVBOX_AUTH_DOMAIN",
+			"auth.jetpack.io",


Does that mean if we ship this cli version, we'd have to keep auth.jetpack.io even if we choose a different domain later on?

If we ever change auth domains, we would need to maintain this one as long as users are on this version of the CLI.

This code won't follow redirects?

savil

nice!

savil · 2023-06-09T23:30:24Z

internal/auth/auth.go

+
+func getAuthFilePath() string {
+	return xdg.StateSubpath(filepath.FromSlash("devbox/auth.json"))
+}


is this mostly taken from the jetpack tool login code? what changes were made?

this stuff is new (launchpad doesn't store auth in state XDG I don't think, it also has a custom struct instead of just storing the auth0 response). The device code polling is inspired by launchpad but heavily modified in order to be simpler and not require a lot of copy pasting or importing (i.e. protos from that repo)

savil · 2023-06-09T23:35:07Z

internal/auth/user.go

+func (u *user) String() string {
+	return u.Email()
+}


I think this is fine for now, but eventually we'd need to move away from email to our own user-id as the true-identifier of a user (since a user may change their email)

Yeah, this is mostly for printing info, not meant to be a canonical ID or anything

LucilleH · 2023-06-09T23:47:47Z

I think this is fine for now, but eventually we'd need to move away from email to our own user-id as the true-identifier of a user (since a user may change their email)

I find myself feeling a little uneasy with this PR, because we are shipping it as part of a CLI binary release, it is hard to change once we shipped it (verses something like devbox.sh, where things are more flexible).

Once we ship this, does that mean we are locked to use auth0 as the auth provider? Can we easily swap provider out if we want to? 🤔

In general, is there a way to make the CLI stay as generic as possible, so that any changes to auth scope, endpoint, provider, or identifier can be made without a release and/or stay backward compatible by default? Just thinking out loud here.

mikeland73 · 2023-06-12T20:58:22Z

As discussed with @loreto and @LucilleH this will go behind feature flag initially to give us a chance to test it out.

alvarogonzalez-packlink · 2023-06-21T10:41:18Z

Is this Devbox Cloud specific, or cloud agnostic?

Edit, to clarify: is the idea I can, for example, push/pull config from a custom bucket my team owns, or just using Devbox Cloud?

## Summary This is stacked on #1114 This implements cloud based global profiles using s3, our existing auth tokens, and identity federation. When user is logged in, we save an IDToken. Tokens are then used to assume an AWS role that allows the user to push and pull data to a path reserved to them. The two commands that do this right now are: ```bash devbox global push devbox global pull ``` (without a url/path) It also improves how we overwrite existing profiles by checking for a profile before downloading the new profile. ## How was it tested? ``` devbox global push devbox global pull ``` (inspected bucket). * Also tried pushing/pulling to path that user did not have access to and it failed. * If you push/pull without being logged in you get an error message.

loreto · 2023-06-21T14:26:29Z

Is this Devbox Cloud specific, or cloud agnostic?

Edit, to clarify: is the idea I can, for example, push/pull config from a custom bucket my team owns, or just using Devbox Cloud?

@alvarogonzalez-packlink Great question.

This feature has nothing to do with our "remote developer environments", it's a different cloud feature to upload and share devbox environments with others. To upload to a cloud store you need to be authenticated. The plan is to build it in a cloud agnostic way; similar to how docker can talk to many different container registries. We're iterating on the feature behind a feature flag, so that we can iron out how to improve it and continue to make it agnostic.

Let me know if you have more thoughts or concerns: would love to hear them so we continue to improve the product!

alvarogonzalez-packlink · 2023-09-12T13:23:52Z

Sorry @loreto , I think I was filtering merged PRs and missed your question.

I was checking this and #1128 , and being a bit confused by the "auth.jetpack.io" workflow, so that's why I asked if this was around Jetpack.io services only, or available for self-hosting.

I haven't checked much the auth workflow, and I don't know much Go and my AWS is a bit rusty 🤣 so I don't know exactly who's doing the auth. By now (and I understand you're still testing) it feels like Jetpack is somehow giving permissions to users to certain buckets, and maybe through the web login process handing the client some authentication key, and then the client uses that key to download, directly from the AWS bucket, the profile.

If I were doing simple self-hosting support, I would do a bunch of things:

Let the user manage authz/authn (that is, they're in charge of creating users, buckets, roles, groups on their cloud platform)
Maybe use a multi-platform / vendor-neutral object storage library to avoid importing a new cloud library each time I want to support a new cloud. Probably something like go-storage. But, for example, the Terraform CLI I mention later, uses the official SDK for every storage backend it supports 🤷
Let that library use the default credentials in the environment, or specify a credential file

So configuration would be a bit like when you define a state backend for Terraform :

Note
If you're not familiar with Terraform, the state contains all the information about the status of your infrastructure the last time you run the Terraform tool. This can be stored in the Terraform Cloud service, or self managed by you in object storage or local path.

You're using Terraform's managed service? You declare that in a file and then do terraform login (I think this is similar to your workflow):

terraform {
  cloud {
    organization = "example_corp"
    ## Required for Terraform Enterprise; Defaults to app.terraform.io for Terraform Cloud
    hostname = "app.terraform.io"

    workspaces {
      tags = ["app"]
    }
  }
}

You self-manage? You declare that bucket in a file, and then by yourself manage whatever permissions you need in that bucket:

terraform {
  backend "s3" {
    bucket = "mybucket"
    key    = "path/to/my/key"
    region = "us-east-1"
  }
}

mikeland73 added 3 commits June 6, 2023 23:39

[auth] Implement device flow auth

4251682

Merge branch 'main' into landau/auth

c663bc7

Organize auth code, add whoami and logout

9d004e5

mikeland73 requested review from gcurtis, savil, loreto and LucilleH and removed request for gcurtis June 8, 2023 00:58

go mod tidy

86672e2

mikeland73 force-pushed the landau/auth branch from 47a0762 to 86672e2 Compare June 8, 2023 01:15

mikeland73 marked this pull request as ready for review June 8, 2023 01:16

Merge branch 'main' into landau/auth

55b85c7

LucilleH reviewed Jun 8, 2023

View reviewed changes

mikeland73 mentioned this pull request Jun 9, 2023

[cloud-profile] Implement push/pull of cloud profile #1128

Merged

savil approved these changes Jun 9, 2023

View reviewed changes

mikeland73 added 2 commits June 12, 2023 16:54

Merge branch 'main' into landau/auth

ae1bf60

Put auth commands behind feature flag

94fec72

mikeland73 merged commit 0102dad into main Jun 12, 2023

mikeland73 deleted the landau/auth branch June 12, 2023 21:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[auth] Implement device flow auth #1114

[auth] Implement device flow auth #1114

Uh oh!

mikeland73 commented Jun 7, 2023 •

edited

Loading

Uh oh!

loreto commented Jun 8, 2023

Uh oh!

mikeland73 commented Jun 8, 2023

Uh oh!

LucilleH Jun 8, 2023 •

edited

Loading

Uh oh!

mikeland73 Jun 9, 2023

Uh oh!

loreto Jun 9, 2023

Uh oh!

savil left a comment

Uh oh!

savil Jun 9, 2023

Uh oh!

mikeland73 Jun 12, 2023

Uh oh!

savil Jun 9, 2023

Uh oh!

mikeland73 Jun 12, 2023

Uh oh!

LucilleH commented Jun 9, 2023 •

edited

Loading

Uh oh!

mikeland73 commented Jun 12, 2023

Uh oh!

alvarogonzalez-packlink commented Jun 21, 2023 •

edited

Loading

Uh oh!

loreto commented Jun 21, 2023

Uh oh!

alvarogonzalez-packlink commented Sep 12, 2023

Uh oh!

Uh oh!

[auth] Implement device flow auth #1114

[auth] Implement device flow auth #1114

Uh oh!

Conversation

mikeland73 commented Jun 7, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How was it tested?

Uh oh!

loreto commented Jun 8, 2023

Uh oh!

mikeland73 commented Jun 8, 2023

Uh oh!

LucilleH Jun 8, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mikeland73 Jun 9, 2023

Choose a reason for hiding this comment

Uh oh!

loreto Jun 9, 2023

Choose a reason for hiding this comment

Uh oh!

savil left a comment

Choose a reason for hiding this comment

Uh oh!

savil Jun 9, 2023

Choose a reason for hiding this comment

Uh oh!

mikeland73 Jun 12, 2023

Choose a reason for hiding this comment

Uh oh!

savil Jun 9, 2023

Choose a reason for hiding this comment

Uh oh!

mikeland73 Jun 12, 2023

Choose a reason for hiding this comment

Uh oh!

LucilleH commented Jun 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mikeland73 commented Jun 12, 2023

Uh oh!

alvarogonzalez-packlink commented Jun 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

loreto commented Jun 21, 2023

Uh oh!

alvarogonzalez-packlink commented Sep 12, 2023

Uh oh!

Uh oh!

mikeland73 commented Jun 7, 2023 •

edited

Loading

LucilleH Jun 8, 2023 •

edited

Loading

LucilleH commented Jun 9, 2023 •

edited

Loading

alvarogonzalez-packlink commented Jun 21, 2023 •

edited

Loading