Page MenuHomeSoftware Heritage
Differential D2747

Add DRF bearer token authentication using OpenID Connect
ClosedPublic
Actions

Authored by anlambert on Mar 2 2020, 6:47 PM.

Details

Reviewers
vlorentz
Group Reviewers
Reviewers
Commits
rDWAPPS61b4f5db76df: auth/backends: Add DRF bearer token authentication using OpenID Connect
Summary

This backend for Django REST Framework enables to authenticate users through the
use of bearer tokens (provided by Keycloak) sent in HTTP request headers.

Related to T1927
Related to T2249

Depends on D2746

Diff Detail

Repository
rDWAPPS Web applications
Branch
oidc-bearer-token-drf-auth
Lint
No Linters Available
Unit
No Unit Test Coverage
Build Status
Buildable 10849
Build 16305: Cypress tests for swh-web diffsJenkins
Build 16304: tox-on-jenkinsJenkins
Build 16303: arc lint + arc unit

Event Timeline

anlambert created this revision.Mar 2 2020, 6:47 PM
Herald added a reviewer: Reviewers. · View Herald TranscriptMar 2 2020, 6:47 PM
swh-public-ci added a comment.Mar 2 2020, 6:51 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/990/ for more details.

anlambert edited the summary of this revision. (Show Details)Mar 2 2020, 6:54 PM
swh-public-ci added a comment.Mar 2 2020, 7:06 PM

Build has FAILED

Link to build: https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/599/
See console output for more information: https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/599/console

Harbormaster failed remote builds in B10849: Diff 9792!Mar 2 2020, 7:06 PM
anlambert updated this revision to Diff 9814.Mar 3 2020, 1:57 PM

Rebase

swh-public-ci added a comment.Mar 3 2020, 2:03 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/992/ for more details.

swh-public-ci added a comment.Mar 3 2020, 2:11 PM

Build has FAILED

Link to build: https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/601/
See console output for more information: https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/601/console

Harbormaster failed remote builds in B10873: Diff 9814!Mar 3 2020, 2:11 PM
vlorentz requested changes to this revision.Mar 3 2020, 6:40 PM
vlorentz added a subscriber: vlorentz.

Nice too! Just a few nitpicks:

swh/web/auth/backends.py
121

You don't need to call .get() again.

And mypy might complain some day that the type of auth_header changes

122

token = auth_header[-1].

But why do we need to support missing auth type? RFC 7235 always requires it (https://tools.ietf.org/html/rfc7235#section-4.2 and https://tools.ietf.org/html/rfc7235#appendix-C )

And it should also check the auth type in case we add more types in the future, so:

(auth_scheme, token) = auth_header.split(' ', 1)
if auth_scheme != 'Bearer':
    raise ...
136

Does the client have control over decoded['exp']? If yes, we should clamp the value of the ttl.

This revision now requires changes to proceed.Mar 3 2020, 6:40 PM
anlambert added inline comments.Mar 4 2020, 4:38 PM
swh/web/auth/backends.py
121

ack

122

Ok, I will improve that part.

136

Ack, will clamp to token max active time.

anlambert updated this revision to Diff 9849.Mar 4 2020, 5:26 PM
anlambert marked 3 inline comments as done.

Update: Address @vlorentz comments

anlambert added a comment.Mar 4 2020, 5:27 PM

Thanks for the review again, diff updated accordingly.

swh-public-ci added a comment.Mar 4 2020, 5:30 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/995/ for more details.

swh-public-ci added a comment.Mar 4 2020, 5:32 PM

Build has FAILED

Link to build: https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/604/
See console output for more information: https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/604/console

Harbormaster failed remote builds in B10915: Diff 9849!Mar 4 2020, 5:32 PM
anlambert updated this revision to Diff 9850.Mar 4 2020, 6:00 PM

Update: Fix cypress tests launch

Since the addition of DRF authentication backends, the following error was reported when
launching swh-web in end to end tests mode:

Traceback (most recent call last):
  File "swh/web/manage.py", line 46, in <module>
    execute_from_command_line(sys.argv)
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/core/management/__init__.py", line 381, in execute_from_command_line
    utility.execute()
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/core/management/__init__.py", line 325, in execute
    settings.INSTALLED_APPS
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/conf/__init__.py", line 79, in __getattr__
    self._setup(name)
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/conf/__init__.py", line 66, in _setup
    self._wrapped = Settings(settings_module)
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/conf/__init__.py", line 157, in __init__
    mod = importlib.import_module(self.SETTINGS_MODULE)
  File "/usr/lib/python3.7/importlib/__init__.py", line 127, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 1006, in _gcd_import
  File "<frozen importlib._bootstrap>", line 983, in _find_and_load
  File "<frozen importlib._bootstrap>", line 967, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 677, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 728, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/home/jenkins/workspace/DWAPPS/cypress-diff/swh/web/settings/tests.py", line 107, in <module>
    from swh.web.tests.data import get_tests_data, override_storages # noqa
  File "/home/jenkins/workspace/DWAPPS/cypress-diff/swh/web/tests/data.py", line 12, in <module>
    from rest_framework.decorators import api_view
  File "/home/jenkins/.local/lib/python3.7/site-packages/rest_framework/decorators.py", line 13, in <module>
    from rest_framework.views import APIView
  File "/home/jenkins/.local/lib/python3.7/site-packages/rest_framework/views.py", line 17, in <module>
    from rest_framework.schemas import DefaultSchema
  File "/home/jenkins/.local/lib/python3.7/site-packages/rest_framework/schemas/__init__.py", line 33, in <module>
    authentication_classes=api_settings.DEFAULT_AUTHENTICATION_CLASSES,
  File "/home/jenkins/.local/lib/python3.7/site-packages/rest_framework/settings.py", line 220, in __getattr__
    val = perform_import(val, attr)
  File "/home/jenkins/.local/lib/python3.7/site-packages/rest_framework/settings.py", line 168, in perform_import
    return [import_from_string(item, setting_name) for item in val]
  File "/home/jenkins/.local/lib/python3.7/site-packages/rest_framework/settings.py", line 168, in <listcomp>
    return [import_from_string(item, setting_name) for item in val]
  File "/home/jenkins/.local/lib/python3.7/site-packages/rest_framework/settings.py", line 177, in import_from_string
    return import_string(val)
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/utils/module_loading.py", line 17, in import_string
    module = import_module(module_path)
  File "/usr/lib/python3.7/importlib/__init__.py", line 127, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "/home/jenkins/workspace/DWAPPS/cypress-diff/swh/web/auth/backends.py", line 20, in <module>
    from swh.web.auth.models import OIDCUser
  File "/home/jenkins/workspace/DWAPPS/cypress-diff/swh/web/auth/models.py", line 9, in <module>
    from django.contrib.auth.models import User
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/contrib/auth/models.py", line 2, in <module>
    from django.contrib.auth.base_user import AbstractBaseUser, BaseUserManager
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/contrib/auth/base_user.py", line 47, in <module>
    class AbstractBaseUser(models.Model):
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/db/models/base.py", line 103, in __new__
    app_config = apps.get_containing_app_config(module)
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/apps/registry.py", line 252, in get_containing_app_config
    self.check_apps_ready()
  File "/home/jenkins/.local/lib/python3.7/site-packages/django/apps/registry.py", line 135, in check_apps_ready
    raise AppRegistryNotReady("Apps aren't loaded yet.")
django.core.exceptions.AppRegistryNotReady: Apps aren't loaded yet.

So move end to end test DRF views implementation in a dedicated module and import it only when required.

swh-public-ci added a comment.Mar 4 2020, 6:04 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/996/ for more details.

swh-public-ci added a comment.Mar 4 2020, 6:10 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/605/ for more details.

Harbormaster completed remote builds in B10916: Diff 9850.Mar 4 2020, 6:10 PM
vlorentz accepted this revision.Mar 5 2020, 12:37 PM
This revision is now accepted and ready to land.Mar 5 2020, 12:37 PM
anlambert updated this revision to Diff 9873.Mar 5 2020, 9:25 PM

Rebase

anlambert added a child revision: D2775: Do not cache requests for authenticated users.Mar 5 2020, 9:29 PM
swh-public-ci added a comment.Mar 5 2020, 9:31 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/998/ for more details.

swh-public-ci added a comment.Mar 5 2020, 9:44 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/607/ for more details.

Harbormaster completed remote builds in B10940: Diff 9873.Mar 5 2020, 9:44 PM
anlambert updated this revision to Diff 9876.Mar 6 2020, 1:55 AM

Rebase

swh-public-ci added a comment.Mar 6 2020, 2:02 AM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/1002/ for more details.

swh-public-ci added a comment.Mar 6 2020, 2:16 AM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/611/ for more details.

Harbormaster completed remote builds in B10943: Diff 9876.Mar 6 2020, 2:16 AM
anlambert updated this revision to Diff 10078.Mar 16 2020, 3:11 PM

Rebase

swh-public-ci added a comment.Mar 16 2020, 3:18 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/1016/ for more details.

swh-public-ci added a comment.Mar 16 2020, 3:30 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/cypress-diff/625/ for more details.

Harbormaster completed remote builds in B11147: Diff 10078.Mar 16 2020, 3:30 PM
Closed by commit rDWAPPS61b4f5db76df: auth/backends: Add DRF bearer token authentication using OpenID Connect (authored by anlambert). · Explain WhyMar 16 2020, 4:01 PM
This revision was automatically updated to reflect the committed changes.
anlambert added a commit: rDWAPPS61b4f5db76df: auth/backends: Add DRF bearer token authentication using OpenID Connect.

Revision Contents
Changeset List

PathSize
swh/
web/
auth/
39 lines
settings/
6 lines
tests/
auth/
90 lines
56 lines

Diff 9792

View Options

swh/web/auth/backends.py

Loading...
View Options

swh/web/settings/common.py

Loading...
View Options

swh/web/tests/auth/test_api_auth.py

Loading...
View Options

swh/web/tests/auth/test_backends.py

Loading...
About · Developer information · Legal