Add the ability to configure and provide Oauth2 #485

Firstyear · 2021-06-17T04:57:03Z

Fixes #329 relates #278. This is the core implementation of Oauth2 for Kanidm. There are still a number of outstanding todos such as:

Resource Server display names
Scope mapping
Authorisation/Filtering of who can access what resource servers
Token introspection
The Web UI elements for a clean workflow
Open ID Connect
Book chapters and documentation of how to configure resource servers

[ x ] cargo fmt has been run
[ x ] cargo clippy has been run
[ x ] cargo test has been run and passes
[ - ] book chapter included (if relevant)
[ x ] design document included (if relevant)

kanidmd/src/lib/constants/schema.rs

QnnOkabayashi

I'm still a little confused where Kanidm comes into the Oauth2 process. We're both the client and the server? Are we the Auth server but not the resource server? What do we do differently from the oauth2 crate?

kanidm_client/src/asynchronous.rs

kanidm_client/tests/oauth2_test.rs

kanidm_proto/src/oauth2.rs

QnnOkabayashi · 2021-06-18T18:35:52Z

kanidmd/src/lib/idm/server.rs

+                if self.qs_write.get_changed_ouath2() {
+                    self.qs_write
+                        .get_oauth2rs_set(au)
+                        .and_then(|oauth2rs_set| self.oauth2rs.reload(oauth2rs_set))?;
+                }
+                // Commit everything.
+                self.oauth2rs.commit();
+                self.pw_badlist_cache.commit();


Wait can you give a quick rundown on what pieces of Oauth2 this file implements? I watched some videos on it but am still very confused.

We are an identity provider.

Consider an application like "gitter". When you go there is says "do you want to authenticate with github?". In this case the "resource server" is gitter, and kanidm would be "github", where we are providing identities and authorisation to external applications.

So ideally in the future there would be options like "Sign in with Kanidm"?

For resource servers, yes, they could add that option. More generically it's "sign in with openidconnect" or "sign in with oauth", which has more relevance inside an organisation that the public internet.

kanidmd/src/lib/lib.rs

kanidmd/src/lib/plugins/oauth2.rs

kanidmd/src/lib/server.rs

kanidmd/src/lib/value.rs

Firstyear · 2021-06-21T03:43:21Z

I'm still a little confused where Kanidm comes into the Oauth2 process. We're both the client and the server? Are we the Auth server but not the resource server? What do we do differently from the oauth2 crate?

Right, oauth2 has three parts:

Client, the browser where a user is sitting
Resource Server, the system or resource you want to access
Identity Provider, the holder of who you are and decided if you have access.

Oauth2 is a system that allows a client, when accessing a resource server, to be redirected to the IDP to make authorisation decisions on behalf of the resource server.

In this way, Kanidm will be the IDP.

We also need to implement some client and resource server behaviour for testing the behaviour of our IDP.

The oauth2 crate is extremely "opinionated" and only implements the components to be a resource server. It is not possible to use it to be a IDP or Client. Additionally, even for our use as an RS, because it's so opinionated it makes it more complex to try and use it as it implements so much magic behind the scenes, that it's a lot simpler to just bypass that crate all together.

edit: you may want to look at https://github.com/kanidm/kanidm/blob/master/designs/oauth.rst for an extended discussion

Does that help?

designs/oauth.rst

victorcwai

Though I am no expert in the domain of OAuth, the core functionalities in this PR seems to be implemented correctly to me.
But I think we should add more comments for the OAuth-related functions. Also we could write down the functions/APIs call flow during a successful authentication session. I think that will make it easier to understand.

kanidm_client/tests/proto_v1_test.rs

kanidmd/src/lib/idm/oauth2.rs

kanidm_proto/src/oauth2.rs

kanidmd/src/lib/modify.rs

kanidmd/src/lib/idm/oauth2.rs

QnnOkabayashi

Is there a way I can see what new changes have been applied since last review? It only shows me which files have changes, not which specific lines.

QnnOkabayashi · 2021-06-25T14:22:04Z

kanidm_client/tests/oauth2_test.rs

+            let form_req = AccessTokenRequest {
+                grant_type: "authorization_code".to_string(),
+                code: code.to_string(),
+                redirect_uri: Url::parse("https://demo.example.com/oauth2/flow")
+                    .expect("Invalid URL"),
+                client_id: None,
+                code_verifier: pkce_code_verifier.secret().clone(),
+            };


Is this how AccessTokenRequests are being created outside of tests too?

Pretty much yeah :)

QnnOkabayashi · 2021-06-25T14:23:26Z

kanidm_client/tests/oauth2_test.rs

+                .await
+                .expect("Unable to decode AccessTokenResponse");
+
+            // Step 4 - inspect the granted token.


Still todo? Isn't this the most important part?

No? Token inspection is another rfc and I after I merge this I plan to open a handful of follow up issues such as token introsection :)

yaleman

I can't find any issues with this, but... that's a low bar :)

…nidm.

Firstyear · 2021-06-29T04:23:54Z

Thank you all for your reviews! I'm going to open some follow up issues now

…nidm. (#485)

Firstyear requested review from QnnOkabayashi, victorcwai and yaleman and removed request for QnnOkabayashi and victorcwai June 17, 2021 04:57

Firstyear commented Jun 17, 2021

View reviewed changes

kanidmd/src/lib/constants/schema.rs Outdated Show resolved Hide resolved

QnnOkabayashi reviewed Jun 18, 2021

View reviewed changes

QnnOkabayashi mentioned this pull request Jun 18, 2021

Removed OperationResponse #489

Merged

5 tasks

Firstyear force-pushed the 329-278-oauth-pkce branch from 06dd4f5 to ef6d0d6 Compare June 21, 2021 03:43

victorcwai reviewed Jun 21, 2021

View reviewed changes

designs/oauth.rst Show resolved Hide resolved

victorcwai reviewed Jun 21, 2021

View reviewed changes

designs/oauth.rst Show resolved Hide resolved

victorcwai reviewed Jun 22, 2021

View reviewed changes

kanidm_client/tests/proto_v1_test.rs Show resolved Hide resolved

kanidmd/src/lib/idm/oauth2.rs Show resolved Hide resolved

kanidm_proto/src/oauth2.rs Show resolved Hide resolved

kanidmd/src/lib/modify.rs Show resolved Hide resolved

victorcwai reviewed Jun 23, 2021

View reviewed changes

kanidmd/src/lib/idm/oauth2.rs Show resolved Hide resolved

Firstyear force-pushed the 329-278-oauth-pkce branch from a41c2e6 to b69d89b Compare June 25, 2021 06:21

QnnOkabayashi approved these changes Jun 25, 2021

View reviewed changes

yaleman approved these changes Jun 25, 2021

View reviewed changes

victorcwai approved these changes Jun 26, 2021

View reviewed changes

Add the ability to configure and provide Oauth2 authentication for Ka…

db5f6a0

…nidm.

Firstyear force-pushed the 329-278-oauth-pkce branch from b69d89b to db5f6a0 Compare June 26, 2021 01:53

Firstyear merged commit 1de1b2d into master Jun 29, 2021

Firstyear deleted the 329-278-oauth-pkce branch June 29, 2021 04:23

Firstyear added a commit that referenced this pull request Jun 30, 2021

Add the ability to configure and provide Oauth2 authentication for Ka…

6364b15

…nidm. (#485)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add the ability to configure and provide Oauth2 #485

Add the ability to configure and provide Oauth2 #485

Firstyear commented Jun 17, 2021

QnnOkabayashi left a comment

QnnOkabayashi Jun 18, 2021

Firstyear Jun 21, 2021

QnnOkabayashi Jun 21, 2021

Firstyear Jun 22, 2021

Firstyear commented Jun 21, 2021 •

edited

Loading

victorcwai left a comment

QnnOkabayashi left a comment

QnnOkabayashi Jun 25, 2021

Firstyear Jun 26, 2021

QnnOkabayashi Jun 25, 2021

Firstyear Jun 26, 2021

yaleman left a comment

Firstyear commented Jun 29, 2021

Add the ability to configure and provide Oauth2 #485

Add the ability to configure and provide Oauth2 #485

Conversation

Firstyear commented Jun 17, 2021

QnnOkabayashi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Firstyear commented Jun 21, 2021 • edited Loading

victorcwai left a comment

Choose a reason for hiding this comment

QnnOkabayashi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yaleman left a comment

Choose a reason for hiding this comment

Firstyear commented Jun 29, 2021

Firstyear commented Jun 21, 2021 •

edited

Loading