Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add logoutredirect URL to oauth-proxy #176

Merged
merged 1 commit into from Jun 2, 2020
Merged

add logoutredirect URL to oauth-proxy #176

merged 1 commit into from Jun 2, 2020

Conversation

deads2k
Copy link

@deads2k deads2k commented May 20, 2020 •
edited

Adds -logout-url=url-to-log-out-of-sso to be peer to https://github.com/openshift/api/blob/master/config/v1/types_console.go#L50-L63

I think this is logically comparable to https://github.com/openshift/console/blob/4efd97f82f824f56da6a1a627dbbd9d677ba9b63/frontend/public/module/auth.js#L72-L80

/assign @stlaz

/cc @jcantrill

The options for exposure are...

  1. this PR which makes the redirect based on an oauth-proxy arg. Doing it like this prevents the web app from choosing a redirect URL that varies by user or by where a user is in the app itself. This is limiting, but easy.
  2. create a different approach that allows a web app to go to the https://oauth-proxy/sign_out?redirect=foo. This allows webapps to choose any redirect based on any criteria. Based on a conversation with @spadgett, this requires creating a csrf token that is embedded in the page, but the logout is owned by the web app, not the oauth-proxy. That makes creating the csrf impractical.

We should go with option 1

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 20, 2020
@stlaz
Copy link
Member

stlaz commented May 20, 2020

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label May 20, 2020
@deads2k
Copy link
Author

deads2k commented May 20, 2020

/hold

just want to hold for manual testing before we commit.

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 20, 2020
@openshift-ci-robot openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label May 20, 2020
@deads2k
Copy link
Author

deads2k commented May 20, 2020

/hold

This proved the concept, but it may make more sense to accept a redirect URL as a query param alongside a CSRF token of some kind. I think I see this happening for the github logout. I suppose it is possible to provide the other option at some point in the future. I'm not familiar enough with browser repercussions to make the choice for a query param without research.

@ewolinetz ewolinetz mentioned this pull request May 20, 2020
Closed
@deads2k
Copy link
Author

deads2k commented May 27, 2020

The options for exposure are...

  1. this PR which makes the redirect based on an oauth-proxy arg. Doing it like this prevents the web app from choosing a redirect URL that varies by user or by where a user is in the app itself. This is limiting, but easy.
  2. create a different approach that allows a web app to go to the https://oauth-proxy/sign_out?redirect=foo. This allows webapps to choose any redirect based on any criteria. Based on a conversation with @spadgett, this requires creating a csrf token that is embedded in the page, but the logout is owned by the web app, not the oauth-proxy. That makes creating the csrf impractical

We should go with option 1

@deads2k
Copy link
Author

deads2k commented May 27, 2020

/hold cancel

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 27, 2020
@deads2k
Copy link
Author

deads2k commented May 27, 2020

This can wait until after 4.5.

@jcantrill
Copy link

LGTM. What is the value we should us or how may we discover the correct one?

@deads2k
Copy link
Author

deads2k commented May 27, 2020

LGTM. What is the value we should us or how may we discover the correct one?

I think you have to have a way to accept user input into your operator. We’ve found these sign out URLs for commonly used IdPs:

  1. https://github.com/logout
  2. https://accounts.google.com/logout
  3. http://auth-server/auth/realms/{realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri - from https://www.keycloak.org/docs/latest/securing_apps/index.html#logout

@sttts
Copy link

sttts commented May 29, 2020

Sgtm.

@stlaz
Copy link
Member

stlaz commented May 29, 2020

/lgtm
fair

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label May 29, 2020
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@stlaz
Copy link
Member

stlaz commented May 29, 2020

/hold
until 4.6 master is open

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 29, 2020
@sttts
Copy link

sttts commented Jun 2, 2020

Master is open again.

/hold cancel

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 2, 2020
@openshift-bot
Copy link

/retest

Please review the full test history for this PR and help us cut down flakes.

3 similar comments
@openshift-bot
Copy link

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

/retest

Please review the full test history for this PR and help us cut down flakes.

1 similar comment
@openshift-bot
Copy link

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit b1d20e6 into openshift:master Jun 2, 2020
@stlaz stlaz mentioned this pull request Sep 30, 2020
Closed
@stlaz stlaz mentioned this pull request Nov 2, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jcantrill jcantrill Awaiting requested review from jcantrill

Assignees

@stlaz stlaz

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@deads2k @stlaz @jcantrill @sttts @openshift-ci-robot @openshift-bot @openshift-merge-robot