forked from flyteorg/flyte
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Oauth support in flytectl (flyteorg#49)
* Using changed flyteidl which contains oauth changes Signed-off-by: Prafulla Mahindrakar <[email protected]> * Added zlando keyring as an implementation of tokencache Signed-off-by: Prafulla Mahindrakar <[email protected]> * Fixed unit tests Signed-off-by: Prafulla Mahindrakar <[email protected]> * Fixed linter issues Signed-off-by: Prafulla Mahindrakar <[email protected]> * go mod tidy Signed-off-by: Prafulla Mahindrakar <[email protected]> * Update to latest flyteidl Signed-off-by: Haytham Abuelfutuh <[email protected]> Signed-off-by: Prafulla Mahindrakar <[email protected]> * Update to released flyteidl Signed-off-by: Haytham Abuelfutuh <[email protected]> Signed-off-by: Prafulla Mahindrakar <[email protected]> Co-authored-by: Haytham Abuelfutuh <[email protected]>
- Loading branch information
1 parent
73e4aa3
commit f103e41
Showing
10 changed files
with
163 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,7 @@ | ||
| admin: | ||
| # For GRPC endpoints you might want to use dns:///flyte.myexample.com | ||
| endpoint: dns:///flyte.lyft.net | ||
| # endpoint: dns:///flyte.lyft.net | ||
| insecure: true | ||
| endpoint: dns:///flyte.myexample.com | ||
| authType: Pkce | ||
| logger: | ||
| show-source: true | ||
| level: 1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| { | ||
| "access_token":"", | ||
| "token_type":"bearer", | ||
| "refresh_token":"eyJhbGciOiJSUzI1NiIsImtleV9pZCI6IjlLZlNILXphZjRjY1dmTlNPbm91YmZUbnItVW5kMHVuY3ctWF9KNUJVdWciLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiaHR0cHM6Ly9kZW1vLm51Y2x5ZGUuaW8iXSwiY2xpZW50X2lkIjoiZmx5dGVjdGwiLCJleHAiOjE2MTk1MzM1MjcsImZvcm0iOnsiY29kZV9jaGFsbGVuZ2UiOiJ2bWNxazArZnJRS3Vvb2FMUHZwUDJCeUtod2VKR2VaeG1mdGtkMml0T042Tk13SVBQNWwySmNpWDd3NTdlaS9iVW1LTWhPSjJVUERnK0F5RXRaTG94SFJiMDl1cWRKSSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlN2WEgyeDh2UDUrSkJxQ0NjT2dCL0hNWjdLSmE3bkdLMDBaUVA0ekd4WGcifSwiaWF0IjoxNjE5NTAyNTM1LCJpc3MiOiJodHRwczovL2RlbW8ubnVjbHlkZS5pbyIsImp0aSI6IjQzMTM1ZWY2LTA5NjEtNGFlZC1hOTYxLWQyZGI1YWJmM2U1YyIsInNjcCI6WyJvZmZsaW5lIiwiZi5hbGwiLCJhY2Nlc3NfdG9rZW4iXSwic3ViIjoiMTE0NTI3ODE1MzA1MTI4OTc0NDcwIiwidXNlcl9pbmZvIjp7ImZhbWlseV9uYW1lIjoiTWFoaW5kcmFrYXIiLCJnaXZlbl9uYW1lIjoiUHJhZnVsbGEiLCJuYW1lIjoiUHJhZnVsbGEgTWFoaW5kcmFrYXIiLCJwaWN0dXJlIjoiaHR0cHM6Ly9saDMuZ29vZ2xldXNlcmNvbnRlbnQuY29tL2EtL0FPaDE0R2p1VDFrOC04YTV2QkdPSUYxYURnaFltRng4aEQ5S05pUjVqblp1PXM5Ni1jIiwic3ViamVjdCI6IjExNDUyNzgxNTMwNTEyODk3NDQ3MCJ9fQ.YKom5-gE4e84rJJIfxcpbMzgjZT33UZ27UTa1y8pK2BAWaPjIZtwudwDHQ5Rd3m0mJJWhBp0j0e8h9DvzBUdpsnGMXSCYKP-ag9y9k5OW59FMm9RqIakWHtj6NPnxGO1jAsaNCYePj8knR7pBLCLCse2taDHUJ8RU1F0DeHNr2y-JupgG5y1vjBcb-9eD8OwOSTp686_hm7XoJlxiKx8dj2O7HPH7M2pAHA_0bVrKKj7Y_s3fRhkm_Aq6LRdA-IiTl9xJQxgVUreejls9-RR9mSTKj6A81-Isz3qAUttVVaA4OT5OdW879_yT7OSLw_QwpXzNZ7qOR7OIpmL_xZXig", | ||
| "expiry":"2021-04-27T19:55:26.658635+05:30" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| { | ||
| "access_token":"eyJhbGciOiJSUzI1NiIsImtleV9pZCI6IjlLZlNILXphZjRjY1dmTlNPbm91YmZUbnItVW5kMHVuY3ctWF9KNUJVdWciLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiaHR0cHM6Ly9kZW1vLm51Y2x5ZGUuaW8iXSwiY2xpZW50X2lkIjoiZmx5dGVjdGwiLCJleHAiOjE2MTk1Mjk5MjcsImZvcm0iOnsiY29kZV9jaGFsbGVuZ2UiOiJ2bWNxazArZnJRS3Vvb2FMUHZwUDJCeUtod2VKR2VaeG1mdGtkMml0T042Tk13SVBQNWwySmNpWDd3NTdlaS9iVW1LTWhPSjJVUERnK0F5RXRaTG94SFJiMDl1cWRKSSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlN2WEgyeDh2UDUrSkJxQ0NjT2dCL0hNWjdLSmE3bkdLMDBaUVA0ekd4WGcifSwiaWF0IjoxNjE5NTAyNTM1LCJpc3MiOiJodHRwczovL2RlbW8ubnVjbHlkZS5pbyIsImp0aSI6IjQzMTM1ZWY2LTA5NjEtNGFlZC1hOTYxLWQyZGI1YWJmM2U1YyIsInNjcCI6WyJvZmZsaW5lIiwiYWxsIiwiYWNjZXNzX3Rva2VuIl0sInN1YiI6IjExNDUyNzgxNTMwNTEyODk3NDQ3MCIsInVzZXJfaW5mbyI6eyJmYW1pbHlfbmFtZSI6Ik1haGluZHJha2FyIiwiZ2l2ZW5fbmFtZSI6IlByYWZ1bGxhIiwibmFtZSI6IlByYWZ1bGxhIE1haGluZHJha2FyIiwicGljdHVyZSI6Imh0dHBzOi8vbGgzLmdvb2dsZXVzZXJjb250ZW50LmNvbS9hLS9BT2gxNEdqdVQxazgtOGE1dkJHT0lGMWFEZ2hZbUZ4OGhEOUtOaVI1am5adT1zOTYtYyIsInN1YmplY3QiOiIxMTQ1Mjc4MTUzMDUxMjg5NzQ0NzAifX0.ojbUOy2tF6HL8fIp1FJAQchU2MimlVMr3EGVPxMvYyahpW5YsWh6mz7qn4vpEnBuYZDf6cTaN50pJ8krlDX9RqtxF3iEfV2ZYHwyKMThI9sWh_kEBgGwUpyHyk98ZeqQX1uFOH3iwwhR-lPPUlpgdFGzKsxfxeFLOtu1y0V7BgA08KFqgYzl0lJqDYWBkJh_wUAv5g_r0NzSQCsMqb-B3Lno5ScMnlA3SZ_Hg-XdW8hnFIlrwJj4Cv47j3fcZxpqLbTNDXWWogmRbJb3YPlgn_LEnRAyZnFERHKMCE9vaBSTu-1Qstp-gRTORjyV7l3y680dEygQS-99KV3OSBlz6g", | ||
| "token_type":"bearer", | ||
| "refresh_token":"eyJhbGciOiJSUzI1NiIsImtleV9pZCI6IjlLZlNILXphZjRjY1dmTlNPbm91YmZUbnItVW5kMHVuY3ctWF9KNUJVdWciLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiaHR0cHM6Ly9kZW1vLm51Y2x5ZGUuaW8iXSwiY2xpZW50X2lkIjoiZmx5dGVjdGwiLCJleHAiOjE2MTk1MzM1MjcsImZvcm0iOnsiY29kZV9jaGFsbGVuZ2UiOiJ2bWNxazArZnJRS3Vvb2FMUHZwUDJCeUtod2VKR2VaeG1mdGtkMml0T042Tk13SVBQNWwySmNpWDd3NTdlaS9iVW1LTWhPSjJVUERnK0F5RXRaTG94SFJiMDl1cWRKSSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlN2WEgyeDh2UDUrSkJxQ0NjT2dCL0hNWjdLSmE3bkdLMDBaUVA0ekd4WGcifSwiaWF0IjoxNjE5NTAyNTM1LCJpc3MiOiJodHRwczovL2RlbW8ubnVjbHlkZS5pbyIsImp0aSI6IjQzMTM1ZWY2LTA5NjEtNGFlZC1hOTYxLWQyZGI1YWJmM2U1YyIsInNjcCI6WyJvZmZsaW5lIiwiZi5hbGwiLCJhY2Nlc3NfdG9rZW4iXSwic3ViIjoiMTE0NTI3ODE1MzA1MTI4OTc0NDcwIiwidXNlcl9pbmZvIjp7ImZhbWlseV9uYW1lIjoiTWFoaW5kcmFrYXIiLCJnaXZlbl9uYW1lIjoiUHJhZnVsbGEiLCJuYW1lIjoiUHJhZnVsbGEgTWFoaW5kcmFrYXIiLCJwaWN0dXJlIjoiaHR0cHM6Ly9saDMuZ29vZ2xldXNlcmNvbnRlbnQuY29tL2EtL0FPaDE0R2p1VDFrOC04YTV2QkdPSUYxYURnaFltRng4aEQ5S05pUjVqblp1PXM5Ni1jIiwic3ViamVjdCI6IjExNDUyNzgxNTMwNTEyODk3NDQ3MCJ9fQ.YKom5-gE4e84rJJIfxcpbMzgjZT33UZ27UTa1y8pK2BAWaPjIZtwudwDHQ5Rd3m0mJJWhBp0j0e8h9DvzBUdpsnGMXSCYKP-ag9y9k5OW59FMm9RqIakWHtj6NPnxGO1jAsaNCYePj8knR7pBLCLCse2taDHUJ8RU1F0DeHNr2y-JupgG5y1vjBcb-9eD8OwOSTp686_hm7XoJlxiKx8dj2O7HPH7M2pAHA_0bVrKKj7Y_s3fRhkm_Aq6LRdA-IiTl9xJQxgVUreejls9-RR9mSTKj6A81-Isz3qAUttVVaA4OT5OdW879_yT7OSLw_QwpXzNZ7qOR7OIpmL_xZXig", | ||
| "expiry":"2021-04-27T19:55:26.658635+05:30" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| package pkce | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
|
|
||
| "github.com/zalando/go-keyring" | ||
| "golang.org/x/oauth2" | ||
| ) | ||
|
|
||
| // TokenCacheKeyringProvider wraps the logic to save and retrieve tokens from the OS's keyring implementation. | ||
| type TokenCacheKeyringProvider struct { | ||
| ServiceName string | ||
| ServiceUser string | ||
| } | ||
|
|
||
| const ( | ||
| KeyRingServiceUser = "flytectl-user" | ||
| KeyRingServiceName = "flytectl" | ||
| ) | ||
|
|
||
| func (t TokenCacheKeyringProvider) SaveToken(token *oauth2.Token) error { | ||
| var tokenBytes []byte | ||
| if token.AccessToken == "" { | ||
| return fmt.Errorf("cannot save empty token with expiration %v", token.Expiry) | ||
| } | ||
|
|
||
| var err error | ||
| if tokenBytes, err = json.Marshal(token); err != nil { | ||
| return fmt.Errorf("unable to marshal token to save in cache due to %w", err) | ||
| } | ||
|
|
||
| // set token in keyring | ||
| if err = keyring.Set(t.ServiceName, t.ServiceUser, string(tokenBytes)); err != nil { | ||
| return fmt.Errorf("unable to save token. Error: %w", err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (t TokenCacheKeyringProvider) GetToken() (*oauth2.Token, error) { | ||
| // get saved token | ||
| tokenJSON, err := keyring.Get(t.ServiceName, t.ServiceUser) | ||
| if len(tokenJSON) == 0 { | ||
| return nil, fmt.Errorf("no token found in the cache") | ||
| } | ||
|
|
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| token := oauth2.Token{} | ||
| if err = json.Unmarshal([]byte(tokenJSON), &token); err != nil { | ||
| return nil, fmt.Errorf("unmarshalling error for saved token. Error: %w", err) | ||
| } | ||
|
|
||
| return &token, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| package pkce | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "io/ioutil" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/zalando/go-keyring" | ||
| "golang.org/x/oauth2" | ||
| ) | ||
|
|
||
| func TestSaveAndGetToken(t *testing.T) { | ||
| keyring.MockInit() | ||
| tokenCacheProvider := TokenCacheKeyringProvider{ | ||
| ServiceUser: "testServiceUser", | ||
| ServiceName: "testServiceName", | ||
| } | ||
|
|
||
| t.Run("Valid Save/Get Token", func(t *testing.T) { | ||
| plan, _ := ioutil.ReadFile("testdata/token.json") | ||
| var tokenData oauth2.Token | ||
| err := json.Unmarshal(plan, &tokenData) | ||
| assert.NoError(t, err) | ||
| err = tokenCacheProvider.SaveToken(&tokenData) | ||
| assert.NoError(t, err) | ||
| var savedToken *oauth2.Token | ||
| savedToken, err = tokenCacheProvider.GetToken() | ||
| assert.NoError(t, err) | ||
| assert.NotNil(t, savedToken) | ||
| assert.Equal(t, tokenData.AccessToken, savedToken.AccessToken) | ||
| assert.Equal(t, tokenData.TokenType, savedToken.TokenType) | ||
| assert.Equal(t, tokenData.Expiry, savedToken.Expiry) | ||
| }) | ||
|
|
||
| t.Run("Empty access token Save", func(t *testing.T) { | ||
| plan, _ := ioutil.ReadFile("testdata/empty_access_token.json") | ||
| var tokenData oauth2.Token | ||
| var err error | ||
| err = json.Unmarshal(plan, &tokenData) | ||
| assert.NoError(t, err) | ||
|
|
||
| err = tokenCacheProvider.SaveToken(&tokenData) | ||
| assert.Error(t, err) | ||
| }) | ||
|
|
||
| t.Run("Different service name", func(t *testing.T) { | ||
| plan, _ := ioutil.ReadFile("testdata/token.json") | ||
| var tokenData oauth2.Token | ||
| err := json.Unmarshal(plan, &tokenData) | ||
| assert.NoError(t, err) | ||
| err = tokenCacheProvider.SaveToken(&tokenData) | ||
| assert.NoError(t, err) | ||
| tokenCacheProvider2 := TokenCacheKeyringProvider{ | ||
| ServiceUser: "testServiceUser2", | ||
| ServiceName: "testServiceName2", | ||
| } | ||
|
|
||
| var savedToken *oauth2.Token | ||
| savedToken, err = tokenCacheProvider2.GetToken() | ||
| assert.Error(t, err) | ||
| assert.Nil(t, savedToken) | ||
| }) | ||
| } |