GitHub proxy part 5: OAuth flow to retrieve GitHub identity #49849

greedy52 · 2024-12-05T22:21:20Z

GitHub proxy #48762

GitHub OAuth flow for authenticated user overview

sequenceDiagram
    participant tsh
    participant client browser
    participant Proxy
    participant Auth
    participant GitHub
                                
    tsh->>Proxy: GitServerClient().CreateGitHubAuthRequest
    Proxy->>Auth: CreateGitHubAuthRequest
    tsh->> client browser: open
    client browser->> GitHub: redirect
    GitHub<<->>Proxy: callback
    Proxy<<->>Auth: verify callback and generate new cert with GitHub user ID
    client browser->>tsh: new cert with GitHub user ID

tsh UX example:

$ tsh status
> Profile URL:        https://teleport-test.stevexin.app:443
  Logged in as:       admin
  Cluster:            teleport-test.stevexin.app
  Roles:              access, auditor, editor
  Kubernetes:         enabled
  Valid until:        2024-12-06 07:36:28 -0500 EST [valid for 10h52m0s]
  Extensions:         login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy

$ tsh git login --github-org goteleport-core-test --force
If browser window does not open automatically, open it by clicking on the link:
 http://127.0.0.1:61928/6481c191-f0f5-47e8-ad7e-60c7a84f53ec
Your GitHub username is greedy52.

$ tsh git ls
Type   Organization         Username URL                                     
------ -------------------- -------- --------------------------------------- 
GitHub goteleport-core-test greedy52 https://github.com/goteleport-core-test 

hint: use 'tsh git clone <git-clone-ssh-url>' to clone a new repository
      use 'tsh git config update' to configure an existing repository to use Teleport
      once the repository is cloned or configured, use 'git' as normal

$ tsh status | grep -A2 GitHub
  GitHub username:    greedy52
  Valid until:        2024-12-06 07:36:28 -0500 EST [valid for 10h49m0s]
  Extensions:         login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy

TODO

make -C integrations/operator crd

greedy52 · 2024-12-05T22:26:54Z

lib/auth/github.go

+	// Auth was successful, return session, certificate, etc. to caller.
+	return a.makeGithubAuthResponse(ctx, req, userState, userResp, params.SessionTTL)
+}
+
+func (a *Server) makeGithubAuthResponse(


just some refactoring to break the big function. same below to split getGithubUserAndTeams

Tener

First pass.

api/proto/teleport/legacy/types/types.proto

api/proto/teleport/userloginstate/v1/userloginstate.proto

api/types/github.go

lib/auth/auth.go

lib/auth/github.go

Tener · 2024-12-06T09:43:17Z

lib/auth/userloginstate/generator.go

@@ -154,6 +164,13 @@ func (g *Generator) Generate(ctx context.Context, user types.User) (*userloginst
 		return nil, trace.Wrap(err)
 	}

+	// Preserve states like GitHub identities across logins.
+	// TODO(greedy52) implement a way to remove the identity or find a way to
+	// avoid keeping the identity forever.


Should we set some kind of TTL corresponding to the TTL returned by Github for the auth request?

I don't think Github provide any meaningful TTL for the identity itself. we might need to introduce something like role.max_external_identity_ttl = 168h

Yes, I think we should put a limit here. A week feels like a reasonable compromise.

Tener

I did another round and I feel comfortable enough approving this. Notably I was already familiar with trickier areas of this PR but it still required above-average effort due to accumulated complexity.

Tener · 2024-12-09T09:59:36Z

tool/tsh/common/git_login.go

+	// TODO(greedy52) make "github-org" optional. Most likely there is only a
+	// single Git server configured anyway so do a "list" op then use the
+	// organization from that Git server. If more than one Git servers are
+	// found, prompt the user to pick one.


A very nice idea.

Tener · 2024-12-09T10:03:26Z

lib/auth/github.go

@@ -537,7 +537,7 @@ func newGithubOAuth2Config(connector types.GithubConnector) oauth2.Config {

 // ValidateGithubAuthCallback validates Github auth callback redirect
 func (a *Server) validateGithubAuthCallback(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*authclient.GithubAuthResponse, error) {
-	logger := log.WithFields(logrus.Fields{teleport.ComponentKey: "github"})
+	logger := a.logger.With(teleport.ComponentKey, "github")


I feel like validateGithubAuthCallback and friends could benefit from refactoring. Right now is probably not the best time, but the original code didn't anticipate the use-cases that have been added with time and it shows. Possibly the opportunity for this will arrive in the future?

lib/client/profile.go

lib/auth/gitserver/gitserverv1/github.go

smallinsky · 2024-12-09T12:48:26Z

lib/auth/gitserver/gitserverv1/github.go

+	}
+
+	in.Request.ConnectorID = uuid
+	in.Request.ConnectorSpec = spec


The ConnectorSpec is marked as Used only in test

teleport/integrations/operator/crdgen/testdata/protofiles/teleport/legacy/types/types.proto

Line 5197 in 6995108

GithubConnectorSpecV3 ConnectorSpec = 15 [(gogoproto.jsontag) = "connector_spec,omitempty"];

i did update api/proto/teleport/legacy/types/types.proto to indicate that ConnectorSpec is for both flows (basically the spec is used when not using "native" GitHub connector). I had a comment in PR description that i need to run make -C integrations/operator crd before merge.

lib/auth/gitserver/gitserverv1/github.go

github-actions · 2024-12-10T16:44:13Z

🤖 Vercel preview here: https://docs-4q81q907q-goteleport.vercel.app/docs

github-actions · 2024-12-10T17:21:07Z

🤖 Vercel preview here: https://docs-ie4zozxl8-goteleport.vercel.app/docs

greedy52 added the no-changelog Indicates that a PR does not require a changelog entry label Dec 5, 2024

greedy52 self-assigned this Dec 5, 2024

greedy52 mentioned this pull request Dec 5, 2024

GitHub proxy #48762

Open

14 tasks

greedy52 commented Dec 5, 2024

View reviewed changes

greedy52 force-pushed the STeve/48762_github_oauth_flow branch from f30da58 to 7e9fd6e Compare December 6, 2024 01:48

greedy52 requested review from Tener, r0mant and smallinsky December 6, 2024 01:49

greedy52 marked this pull request as ready for review December 6, 2024 01:49

github-actions bot added size/lg tsh tsh - Teleport's command line tool for logging into nodes running Teleport. labels Dec 6, 2024

github-actions bot requested review from creack and fspmarshall December 6, 2024 01:49

GitHub proxy part 5: OAuth flow to retrieve GitHub identity

5ab9743

greedy52 force-pushed the STeve/48762_github_oauth_flow branch from 7e9fd6e to 5ab9743 Compare December 6, 2024 02:17

Tener reviewed Dec 6, 2024

View reviewed changes

review comments round1

b5d38f5

greedy52 requested a review from Tener December 9, 2024 01:59

Tener approved these changes Dec 9, 2024

View reviewed changes

smallinsky reviewed Dec 9, 2024

View reviewed changes

review comments round 2 and update tsh git list

c20d7ef

greedy52 force-pushed the STeve/48762_github_oauth_flow branch from 3ee441e to c20d7ef Compare December 10, 2024 03:06

greedy52 requested a review from smallinsky December 10, 2024 03:10

smallinsky approved these changes Dec 10, 2024

View reviewed changes

public-teleport-github-review-bot bot removed request for r0mant, creack and fspmarshall December 10, 2024 08:26

make -C integrations/operator crd

7fc3873

greedy52 temporarily deployed to vercel December 10, 2024 16:33 — with GitHub Actions Inactive

greedy52 added 2 commits December 10, 2024 11:59

make -C integrations/terraform docs

7f9eaf2

fix flaky test

e1703d8

greedy52 temporarily deployed to vercel December 10, 2024 17:10 — with GitHub Actions Inactive

greedy52 added this pull request to the merge queue Dec 10, 2024

Merged via the queue into master with commit 80a58fc Dec 10, 2024
44 checks passed

greedy52 deleted the STeve/48762_github_oauth_flow branch December 10, 2024 17:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub proxy part 5: OAuth flow to retrieve GitHub identity #49849

GitHub proxy part 5: OAuth flow to retrieve GitHub identity #49849

greedy52 commented Dec 5, 2024 •

edited

Loading

greedy52 Dec 5, 2024

Tener left a comment

Tener Dec 6, 2024

greedy52 Dec 9, 2024

Tener Dec 9, 2024

Tener left a comment

Tener Dec 9, 2024

Tener Dec 9, 2024

smallinsky Dec 9, 2024

greedy52 Dec 10, 2024

github-actions bot commented Dec 10, 2024

github-actions bot commented Dec 10, 2024

GitHub proxy part 5: OAuth flow to retrieve GitHub identity #49849

GitHub proxy part 5: OAuth flow to retrieve GitHub identity #49849

Conversation

greedy52 commented Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Tener left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Tener left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Dec 10, 2024

github-actions bot commented Dec 10, 2024

greedy52 commented Dec 5, 2024 •

edited

Loading