feat(api, cli, ui): auth consumer token expiration and last authentication #5822

fsamin · 2021-05-21T13:25:58Z

No description provided.

Signed-off-by: francois samin <[email protected]>

engine/sql/api/223_auth_token_expiration.sql

richardlt · 2021-05-27T08:13:56Z

cli/cdsctl/consumer.go

@@ -86,6 +87,9 @@ var authConsumerNewCmd = cli.Command{
 			Name:  "scopes",
 			Type:  cli.FlagSlice,
 			Usage: "Define the list of scopes for the consumer",
+		}, {
+			Name:  "duration",
+			Usage: "Validity period of the token generated for the consumer",


Suggested change

Usage: "Validity period of the token generated for the consumer",

Usage: "Validity period of the token generated for the consumer (in days)",

richardlt · 2021-05-31T08:34:59Z

engine/api/auth_consumer.go

+			req.NewDuration = api.Config.Auth.TokenDefaultDuration
+		}
+		var overlapDuration time.Duration
+		if req.OverlapDuration != "" {


Maybe we should check that overlap duration is less than duration ?

richardlt · 2021-05-31T08:37:55Z

engine/api/auth_consumer.go

+		}
+		var overlapDuration time.Duration
+		if req.OverlapDuration != "" {
+			overlapDuration, err = time.ParseDuration(req.OverlapDuration)


Why not both overlap and validity duration in same format (string duration vs count of hours) ?

because overlap should be in minutes or hours, and validity should be a matter of days

richardlt · 2021-05-31T08:44:46Z

engine/api/authentication/consumer.go

@@ -24,7 +24,8 @@ func NewConsumerWorker(ctx context.Context, db gorpmapper.SqlExecutorWithTx, nam
 			sdk.AuthConsumerScopeRunExecution,
 			sdk.AuthConsumerScopeService,
 		),
-		IssuedAt: time.Now(),
+		//IssuedAt: time.Now(),


To remove ?

richardlt · 2021-05-31T08:44:51Z

engine/api/authentication/consumer.go

@@ -46,7 +47,8 @@ func NewConsumerExternal(ctx context.Context, db gorpmapper.SqlExecutorWithTx, u
 			"username":    userInfo.Username,
 			"email":       userInfo.Email,
 		},
-		IssuedAt: time.Now(),
+		//IssuedAt: time.Now(),


To remove ?

richardlt · 2021-05-31T08:45:45Z

engine/api/authentication/dao_consumer.go

@@ -127,6 +128,7 @@ func InsertConsumer(ctx context.Context, db gorpmapper.SqlExecutorWithTx, ac *sd

 // UpdateConsumer in database.
 func UpdateConsumer(ctx context.Context, db gorpmapper.SqlExecutorWithTx, ac *sdk.AuthConsumer) error {
+	ac.ValidityPeriods.Sort()


Could be nice to sort also on get.

richardlt · 2021-05-31T08:57:55Z

engine/api/authentication/builtin/signin.go

+func checkSigninConsumerTokenIssuedAt(ctx context.Context, payload signinBuiltinConsumerToken, v sdk.AuthConsumerValidityPeriod) (string, error) {
+	var eqIAT = payload.IAT == v.IssuedAt.Unix()
+	var hasRevoke = v.Duration > 0
+	var beforeRevoke = time.Now().Before(v.IssuedAt.Add(v.Duration))


Maybe only one afterRevoke value should be clearer.

richardlt · 2021-05-31T12:38:04Z

engine/api/authentication/builtin/signin.go

 	}
-	return authentication.SignJWS(payload, 0) // 0 means no expiration time
+	return authentication.SignJWS(payload, latestValidityPeriod.Duration)


Add issued at value as parameter instead of using time.Now inside SignJWS func

richardlt · 2021-05-31T12:44:08Z

engine/api/auth_local.go

@@ -150,7 +150,7 @@ func initBuiltinConsumersFromStartupConfig(ctx context.Context, tx gorpmapper.Sq
 			Data:               map[string]string{},
 			GroupIDs:           []int64{group.SharedInfraGroup.ID},
 			ScopeDetails:       scopes,
-			IssuedAt:           time.Unix(startupConfig.IAT, 0),
+			ValidityPeriods:    sdk.NewAuthConsumerValidityPeriod(time.Unix(startupConfig.IAT, 0), 0),


Set a value for services consumers validity period that can be greater than other consumers. Maybe we should update doc for services setup where 'consumer new' command is used.

Signed-off-by: francois samin <[email protected]>

ovh-cds · 2021-05-31T15:57:29Z

CDS Report build-all-cds#16086.0 ✘

Build
- Build and Package All ✔
- Build Debpacker ✔
- Build OS-Ansible-Inventory ✔
- Build SMTPMock ✔
- Lint UI Translate ✔
- Test CLI ✔
- Test Engine ✘
- Test SDK ✔
- Test SDK Rust ✔
- Test UI ✔

Signed-off-by: francois samin <[email protected]>

ovh-cds · 2021-06-07T13:55:05Z

CDS Report build-all-cds#16108.0 ✘

Build
- Build and Package All ✔
- Build Debpacker ✔
- Build OS-Ansible-Inventory ✔
- Build SMTPMock ✔
- Lint UI Translate ✔
- Test CLI ✔
- Test Engine ✔
- Test SDK ✔
- Test SDK Rust ✔
- Test UI ✔
Package
- Docker ✘

ovh-cds · 2021-06-08T14:00:33Z

CDS Report build-all-cds#16108.1 ✘

Build
- Build and Package All ✔
- Build Debpacker ✔
- Build OS-Ansible-Inventory ✔
- Build SMTPMock ✔
- Lint UI Translate ✔
- Test CLI ✔
- Test Engine ✔
- Test SDK ✔
- Test SDK Rust ✔
- Test UI ✔
Package
- Docker ✔
Integration
- Docker Compose Tests ✔
- Standalone Tests ✘

ovh-cds · 2021-06-09T16:24:36Z

CDS Report build-all-cds#16108.2 ✘

Build
- Build and Package All ✔
- Build Debpacker ✔
- Build OS-Ansible-Inventory ✔
- Build SMTPMock ✔
- Lint UI Translate ✔
- Test CLI ✔
- Test Engine ✔
- Test SDK ✔
- Test SDK Rust ✔
- Test UI ✔
Package
- Docker ✘

ovh-cds · 2021-06-10T07:26:07Z

CDS Report build-all-cds#16108.3 ✘

Build
- Build and Package All ✔
- Build Debpacker ✔
- Build OS-Ansible-Inventory ✔
- Build SMTPMock ✔
- Lint UI Translate ✔
- Test CLI ✔
- Test Engine ✔
- Test SDK ✔
- Test SDK Rust ✔
- Test UI ✔
Package
- Docker ✘

Signed-off-by: francois samin <[email protected]>

ovh-cds · 2021-06-14T10:34:48Z

CDS Report build-all-cds#16141.0 ✘

Build
- Build and Package All ✔
- Build Debpacker ✔
- Build OS-Ansible-Inventory ✔
- Build SMTPMock ✔
- Lint UI Translate ✔
- Test CLI ✔
- Test Engine ✔
- Test SDK ✔
- Test SDK Rust ✔
- Test UI ✔
Package
- Docker ✔
Integration
- Docker Compose Tests ✔
- Standalone Tests ✘

sonarqubecloud · 2021-06-14T12:29:55Z

SonarCloud Quality Gate failed.

0 Bugs
0 Vulnerabilities
0 Security Hotspots
2 Code Smells

40.0% Coverage
0.0% Duplication

fsamin requested review from richardlt, sguiheux and yesnault as code owners May 21, 2021 13:25

fsamin changed the title ~~feat(api, ui): auth consumer token expiration and last authentication~~ feat(api, cli, ui): auth consumer token expiration and last authentication May 21, 2021

fsamin added 7 commits May 21, 2021 18:03

wip

3914a83

Signed-off-by: francois samin <[email protected]>

wip

7c85425

Signed-off-by: francois samin <[email protected]>

wip

a215387

Signed-off-by: francois samin <[email protected]>

wip

85112da

Signed-off-by: francois samin <[email protected]>

feat(api, ui): auth consumer last authentication

823b666

Signed-off-by: francois samin <[email protected]>

fix: cr

841f5c5

Signed-off-by: francois samin <[email protected]>

fix: rc

639834c

Signed-off-by: francois samin <[email protected]>

fsamin force-pushed the feat/api/auth_token_expiration branch from ee1d0de to 639834c Compare May 21, 2021 16:06

fsamin added 2 commits May 24, 2021 12:09

fix: test flakiness

c4ffda0

Signed-off-by: francois samin <[email protected]>

fix: test flakiness

494bec2

Signed-off-by: francois samin <[email protected]>

yesnault requested changes May 24, 2021

View reviewed changes

engine/sql/api/223_auth_token_expiration.sql Outdated Show resolved Hide resolved

richardlt requested changes May 31, 2021

View reviewed changes

fix: cr

2d6a902

Signed-off-by: francois samin <[email protected]>

fix: cr

5a0b4b1

Signed-off-by: francois samin <[email protected]>

fsamin requested review from yesnault and richardlt June 9, 2021 15:52

yesnault previously approved these changes Jun 14, 2021

View reviewed changes

richardlt previously approved these changes Jun 14, 2021

View reviewed changes

fsamin added 2 commits June 14, 2021 11:30

Merge branch 'master' into feat/api/auth_token_expiration

1d99ba9

fix: cr

27287c4

Signed-off-by: francois samin <[email protected]>

fsamin dismissed stale reviews from richardlt and yesnault via 27287c4 June 14, 2021 09:31

Merge branch 'master' into feat/api/auth_token_expiration

7dfe111

sguiheux approved these changes Jun 14, 2021

View reviewed changes

ovh deleted a comment from ovh-cds Jun 15, 2021

yesnault approved these changes Jun 15, 2021

View reviewed changes

ovh deleted a comment from ovh-cds Jun 15, 2021

richardlt approved these changes Jun 15, 2021

View reviewed changes

sguiheux merged commit 2581044 into master Jun 16, 2021

fsamin deleted the feat/api/auth_token_expiration branch June 25, 2021 08:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(api, cli, ui): auth consumer token expiration and last authentication #5822

feat(api, cli, ui): auth consumer token expiration and last authentication #5822

fsamin commented May 21, 2021

richardlt May 27, 2021

richardlt May 31, 2021

fsamin Jun 7, 2021

richardlt May 31, 2021

fsamin May 31, 2021

richardlt May 31, 2021

richardlt May 31, 2021

richardlt May 31, 2021

fsamin Jun 7, 2021

richardlt May 31, 2021

richardlt May 31, 2021

richardlt May 31, 2021

ovh-cds commented May 31, 2021

ovh-cds commented Jun 7, 2021

ovh-cds commented Jun 8, 2021

ovh-cds commented Jun 9, 2021

ovh-cds commented Jun 10, 2021

ovh-cds commented Jun 14, 2021

sonarqubecloud bot commented Jun 14, 2021

	Usage: "Validity period of the token generated for the consumer",
	Usage: "Validity period of the token generated for the consumer (in days)",

feat(api, cli, ui): auth consumer token expiration and last authentication #5822

feat(api, cli, ui): auth consumer token expiration and last authentication #5822

Conversation

fsamin commented May 21, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ovh-cds commented May 31, 2021

ovh-cds commented Jun 7, 2021

ovh-cds commented Jun 8, 2021

ovh-cds commented Jun 9, 2021

ovh-cds commented Jun 10, 2021

ovh-cds commented Jun 14, 2021

sonarqubecloud bot commented Jun 14, 2021