Client Login via device authorization flow by mlsmaycon · Pull Request #309 · netbirdio/netbird

mlsmaycon · 2022-05-09T10:09:40Z

The client will fetch the device authorization flow information from management and will use it to login using our hosted provider.

moved the OAuth package to internal as we only have one option
use management URL in the service configuration
Added SSO login to UI and CLI clients
Check if the client is logged in when starting UI
retrieve device authorization flow information from management

Removing this package because there is no other provider at the moment and there is no use for the interface yet

We won't support only auth0 and renaming makes sense in the long run

Added a StatusNeedsLogin to trigger login when needed Updated the status command

Check for missing setup key or sso input

braginini · 2022-05-09T21:58:07Z

@mlsmaycon do we really need --sso?

When there is no setup key provided then it should be interactive login by default, right?

mlsmaycon · 2022-05-09T22:03:31Z

@mlsmaycon do we really need --sso?

When there is no setup key provided then it should be interactive login by default, right?

we do for now, for self-hosted users, we will make it default in new releases

braginini · 2022-05-10T08:42:16Z

running wiretrustee status if the status is NeedLogin the message is the following:

INFO[2022-05-10T10:14:53+02:00] status: NeedsLogin                           
INFO[2022-05-10T10:14:53+02:00] run the login command with a valid setup key or initiate a SSO login, see https://www.netbird.io/docs/overview/setup-keys for more info

Maybe instead of saying to use a LOGIN command should we recommend the UP command?

after running wiretrustee up with a setup-key the status is set to Connected, but if I run wiretrustee login with a setup key afterward then the status is set to Idle. Should ignore actually

@mlsmaycon

Output from Down,UP and Login commands are going to stdout and stderr Silencing the help output after an error on CLI Better message when setup-key is invalid

…erver

Created a provider client interface Login flow will run on daemon. A new method to wait sso login was added

removed log errors from client in favor of clean error response that gets printed out

braginini · 2022-05-12T07:23:33Z

@mlsmaycon

When doing first run:
sudo rm -rf /etc/wiretrustee/config.json && sudo systemctl restart wiretrustee.service

Log output. The PermissionDenied error is okay, right? We first try to log in and see, that the device has not been registered.
Maybe we shouldn't out it? It is a part of normal logic, not something abnormal. Or maybe we could just state in log that the status is LoginRequired.

time="2022-05-12T09:19:37+02:00" level=info msg="starting service"
time="2022-05-12T09:19:37+02:00" level=info msg="generating new config /etc/wiretrustee/config.json"
time="2022-05-12T09:19:37+02:00" level=info msg="started daemon server: /var/run/wiretrustee.sock"
time="2022-05-12T09:19:37+02:00" level=error msg="peer registration required. Please run wiretrustee login command first"
time="2022-05-12T09:19:37+02:00" level=warning msg="rpc error: code = PermissionDenied desc = provided peer with the key wgPubKey yv1sR4rlyEON8EwZbgt7h3kul8j5IF3ED31wWSJahxM= is not registered"

braginini · 2022-05-12T07:26:20Z

@mlsmaycon

When doing the first run and then
wiretrustee up --management-url http://localhost:33073

There is an error in the log:

time="2022-05-12T09:24:22+02:00" level=info msg="starting service"
time="2022-05-12T09:24:22+02:00" level=info msg="generating new config /etc/wiretrustee/config.json"
time="2022-05-12T09:24:22+02:00" level=info msg="started daemon server: /var/run/wiretrustee.sock"
time="2022-05-12T09:24:22+02:00" level=error msg="peer registration required. Please run wiretrustee login command first"
time="2022-05-12T09:24:22+02:00" level=warning msg="rpc error: code = PermissionDenied desc = provided peer with the key wgPubKey AjjCR5QapL4tMT2qLFUk5E/t8zpcwDKl2w8yuAmhY1k= is not registered"
time="2022-05-12T09:24:27+02:00" level=info msg="new Management URL provided, updated to http://localhost:33073 (old value https://api.wiretrustee.com:33073)"
time="2022-05-12T09:24:27+02:00" level=info msg="new Admin Panel URL provided, updated to https://app.netbird.io (old value <nil>)"
time="2022-05-12T09:24:32+02:00" level=info msg="peer has been successfully registered on Management Service"
time="2022-05-12T09:24:33+02:00" level=info msg="connected to the Signal Service stream"
time="2022-05-12T09:24:33+02:00" level=info msg="Wiretrustee engine started, my IP is: 100.64.0.3/24"
time="2022-05-12T09:24:33+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:33+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:34+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:34+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:35+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:35+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:36+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:36+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:36+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:36+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:37+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:37+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:37+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:37+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"

mlsmaycon · 2022-05-12T09:03:50Z

@mlsmaycon

When doing the first run and then wiretrustee up --management-url http://localhost:33073

There is an error in the log:

time="2022-05-12T09:24:22+02:00" level=info msg="starting service"
time="2022-05-12T09:24:22+02:00" level=info msg="generating new config /etc/wiretrustee/config.json"
time="2022-05-12T09:24:22+02:00" level=info msg="started daemon server: /var/run/wiretrustee.sock"
time="2022-05-12T09:24:22+02:00" level=error msg="peer registration required. Please run wiretrustee login command first"
time="2022-05-12T09:24:22+02:00" level=warning msg="rpc error: code = PermissionDenied desc = provided peer with the key wgPubKey AjjCR5QapL4tMT2qLFUk5E/t8zpcwDKl2w8yuAmhY1k= is not registered"
time="2022-05-12T09:24:27+02:00" level=info msg="new Management URL provided, updated to http://localhost:33073 (old value https://api.wiretrustee.com:33073)"
time="2022-05-12T09:24:27+02:00" level=info msg="new Admin Panel URL provided, updated to https://app.netbird.io (old value <nil>)"
time="2022-05-12T09:24:32+02:00" level=info msg="peer has been successfully registered on Management Service"
time="2022-05-12T09:24:33+02:00" level=info msg="connected to the Signal Service stream"
time="2022-05-12T09:24:33+02:00" level=info msg="Wiretrustee engine started, my IP is: 100.64.0.3/24"
time="2022-05-12T09:24:33+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:33+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:34+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:34+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:35+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:35+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:36+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:36+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:36+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:36+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:37+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:37+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"
time="2022-05-12T09:24:37+02:00" level=info msg="connected to the Management Service stream"
time="2022-05-12T09:24:37+02:00" level=error msg="failed handling an update message received from Management Service: wgtypes: failed to parse base64-encoded key: illegal base64 data at input byte 44"

Was a local issue with peers in testing account

mlsmaycon · 2022-05-12T09:04:30Z

@mlsmaycon

When doing first run: sudo rm -rf /etc/wiretrustee/config.json && sudo systemctl restart wiretrustee.service

Log output. The PermissionDenied error is okay, right? We first try to log in and see, that the device has not been registered. Maybe we shouldn't out it? It is a part of normal logic, not something abnormal. Or maybe we could just state in log that the status is LoginRequired.
time="2022-05-12T09:19:37+02:00" level=info msg="starting service"
time="2022-05-12T09:19:37+02:00" level=info msg="generating new config /etc/wiretrustee/config.json"
time="2022-05-12T09:19:37+02:00" level=info msg="started daemon server: /var/run/wiretrustee.sock"
time="2022-05-12T09:19:37+02:00" level=error msg="peer registration required. Please run wiretrustee login command first"
time="2022-05-12T09:19:37+02:00" level=warning msg="rpc error: code = PermissionDenied desc = provided peer with the key wgPubKey yv1sR4rlyEON8EwZbgt7h3kul8j5IF3ED31wWSJahxM= is not registered"

expected as our internal.Login outputs logs before returning.

UI and CLI Clients are now able to use SSO login by default we will check if the management has configured or supports SSO providers daemon will handle fetching and waiting for an access token Oauth package was moved to internal to avoid one extra package at this stage Secrets were removed from OAuth CLI clients have less and better output 2 new status were introduced, NeedsLogin and FailedLogin for better messaging With NeedsLogin we no longer have endless login attempts

mlsmaycon added 8 commits May 8, 2022 11:50

Expand GetConfigResponse with DeviceAuthorizationFlow

c3da0c5

Remove oauth package and merge into internal

ee6fee2

Removing this package because there is no other provider at the moment and there is no use for the interface yet

Rename type to Hosted

990f83b

We won't support only auth0 and renaming makes sense in the long run

Rename methods and const to Hosted

aebfaee

Configure with management URL too

12f0720

Retrieve device auth flow info frrom management

1f1c7b3

Add menu login button

b0811d9

Check Login status and fetch flow info only when config exists

1cd8336

mlsmaycon requested a review from braginini May 9, 2022 10:09

mlsmaycon added 3 commits May 9, 2022 14:06

WIP: adding status StatusNeedsLogin

6a5db56

Removed Login button and merged func into connect

6d31937

Added a StatusNeedsLogin to trigger login when needed Updated the status command

Added CLI support for sso login with flag --sso

ef185bc

Check for missing setup key or sso input

mlsmaycon marked this pull request as ready for review May 9, 2022 21:50

mlsmaycon added 3 commits May 9, 2022 23:52

fix golangci-lint note, simple return err == nil'

230c6ec

Merge branch 'main' into client-device-authorization

69f87e0

sync go mod

8981681

mlsmaycon added 6 commits May 11, 2022 11:09

SSO Login is default for login and up

8246d09

Output from Down,UP and Login commands are going to stdout and stderr Silencing the help output after an error on CLI Better message when setup-key is invalid

SSO Login is default for login and up

a1b8920

Output from Down,UP and Login commands are going to stdout and stderr Silencing the help output after an error on CLI Better message when setup-key is invalid

Handle Unimplemented error when communicating with older management s…

252af89

…erver

Move sso login logic to daemon

abb9a1d

Created a provider client interface Login flow will run on daemon. A new method to wait sso login was added

Update clients to call sso login in the daemon

7721459

removed log errors from client in favor of clean error response that gets printed out

Fix update setting func

5b29660

mlsmaycon and others added 2 commits May 12, 2022 10:03

Handle new configuration file on daemon start

54fab31

Fix chmod of the socket file

a54a978

braginini approved these changes May 12, 2022

View reviewed changes

mlsmaycon merged commit e5c52ef into main May 12, 2022

mlsmaycon deleted the client-device-authorization branch May 12, 2022 09:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Client Login via device authorization flow - #309

Client Login via device authorization flow#309
mlsmaycon merged 22 commits into
mainfrom
client-device-authorization

mlsmaycon commented May 9, 2022 •

edited

Loading

Uh oh!

braginini commented May 9, 2022

Uh oh!

mlsmaycon commented May 9, 2022

Uh oh!

braginini commented May 10, 2022

Uh oh!

braginini commented May 12, 2022

Uh oh!

braginini commented May 12, 2022

Uh oh!

mlsmaycon commented May 12, 2022

Uh oh!

mlsmaycon commented May 12, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

mlsmaycon commented May 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

braginini commented May 9, 2022

Uh oh!

mlsmaycon commented May 9, 2022

Uh oh!

braginini commented May 10, 2022

Uh oh!

braginini commented May 12, 2022

Uh oh!

braginini commented May 12, 2022

Uh oh!

mlsmaycon commented May 12, 2022

Uh oh!

mlsmaycon commented May 12, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mlsmaycon commented May 9, 2022 •

edited

Loading