Google, IDMan and static api key auth #316

santanusinha · 2020-04-08T22:22:38Z

No description provided.

removed unwanted console log form function.js file

Bug fix n UI

Remove ttl from table

…ig completely optional

nitishgoyal13 · 2020-04-09T02:03:00Z

config/docker.yml

+  enabled: ${AUTH_ENABLED}
+  jwt:
+    issuerId: foxtrot-server
+    privateKey: "6/Qh1eLvF7cGJEgH1wIMYErIpi0d8Kqt5wHKw/o5iFbhfziKiux03HfFihO2+f5FKpsjk1D7UmgdAWQsY966WkyAsyo22m4g+C+rNCwMUD/UM2qop7JZBDEkgWpwK8jpxOTpYUnaNsiBaBsadoZCQ+Ns/d8RrS7QPAW+1PETbdFfo+fPW0/Sm8RUmMKkc9jJ6bhuSpFH3q/bWoyPZnj7geYQQIkgmQv9jXaszw=="


Is it okay to expose this private key here?

This is some test key... not to be used in production. Moving it to compose file.

wait .. no this is outdated... All these have already been moved to compose file.

nitishgoyal13 · 2021-08-02T02:34:45Z

foxtrot-core/src/main/java/com/flipkart/foxtrot/core/auth/User.java

+
+    String id;
+    Set<FoxtrotRole> roles;
+    Set<String> tables;


Does this mean a user would have same set of roles on a list of tables? Shouldn't it like user have higher access on tables which he owns and only read access on tables belonging to other teams

Right now it is same across all tables to keep it simple. We can change this model later on if needed.

Will change in different PR.

nitishgoyal13 · 2021-08-02T02:47:48Z

foxtrot-server/pom.xml

+        <dependency>
+            <groupId>io.appform.idman</groupId>
+            <artifactId>idman-model</artifactId>
+            <version>1.0-SNAPSHOT</version>


Can be updated to release version

nitishgoyal13 · 2021-08-02T02:56:04Z

foxtrot-server/src/main/java/com/flipkart/foxtrot/server/auth/AuthStore.java

+
+    Optional<User> getUser(final String userId);
+
+    boolean deleteUser(final String id);


Is this delete by userId? If yes, id can be changed to userId to make it consistent with getUser

nitishgoyal13 · 2021-08-02T02:56:24Z

foxtrot-server/src/main/java/com/flipkart/foxtrot/server/auth/AuthStore.java

+
+    boolean deleteUser(final String id);
+
+    boolean updateUser(final String id, UnaryOperator<User> mutator);


Same as above

nitishgoyal13 · 2021-08-02T14:04:05Z

...ver/src/main/java/com/flipkart/foxtrot/server/auth/authprovider/impl/GoogleAuthProvider.java

+                    Preconditions.checkArgument(!Strings.isNullOrEmpty(googleAuthConfig.getProxyHost()));
+                    proxy = new Proxy(Proxy.Type.HTTP,
+                                      new InetSocketAddress(googleAuthConfig.getProxyHost(),
+                                                            googleAuthConfig.getProxyPort()));


This implementation is same as HTTP implementation

Done .. good catch

nitishgoyal13 · 2021-08-03T03:42:07Z

...rver/src/main/java/com/flipkart/foxtrot/server/auth/authprovider/impl/IdmanAuthProvider.java

+            String param,
+            Function<TokenInfo, Optional<T>> handler) throws URISyntaxException, IOException {
+        val post = new HttpPost(new URIBuilder(config.getIdmanEndpoint())
+                                        .setPath("/apis/oauth2/token")


Where would IDMan be hosted? This would mean IDMan always have to be available if someone is using IDMan Auth

It will be hosted separately for an org. Yes, it needs to be available for people to be able to login. Just like google needs to be up and working for people to login using google. Once authenticated, the auth info is cached for some time.

nitishgoyal13 · 2021-08-03T03:43:18Z

...rver/src/main/java/com/flipkart/foxtrot/server/auth/authprovider/impl/IdmanAuthProvider.java

+                return EnumSet.allOf(FoxtrotRole.class);
+            }
+            case "FOXTROT_HUMAN_USER": {
+                return EnumSet.of(FoxtrotRole.CONSOLE, FoxtrotRole.QUERY, FoxtrotRole.INGEST);


Human user needn't have Ingest role? Ideally ingestion should be happening only via systems

Sometimes, needed for testing. But i generally agree. Removing.

nitishgoyal13 · 2021-08-03T04:27:32Z

foxtrot-server/src/main/java/com/flipkart/foxtrot/server/resources/Auth.java

+
+    @PUT
+    @Path("/users/{userId}/roles/grant/{role}")
+    public Response grantRole(@NotNull @NotEmpty @PathParam("userId") final String userId,


Should we expose an api to grant multiple roles in one request?

Roles can be granted in bunch during creation of user. This is for granting one at a time. But can be added in different pull request if needed.

nitishgoyal13 · 2021-08-03T04:28:13Z

foxtrot-server/src/main/java/com/flipkart/foxtrot/server/resources/Auth.java

+    @PUT
+    @Path("/users/{userId}/tables/access/grant/{table}")
+    public Response grantTableAccess(@NotNull @NotEmpty @PathParam("userId") final String userId,
+                                    @NotNull @NotEmpty @PathParam("table") final String table) {


Should we expose an api to grant multiple tables in one request? If an installation of foxtrot has multiple tables, it will be lot of work for the admin to give access to each user for multiple tables

Build Fix

…_auth

santanusinha · 2022-02-02T10:40:26Z

This is merged via different path

nitishgoyal13 and others added 18 commits March 20, 2020 19:29

Changes from gitlab

38b6bec

Changes from gitlab

5fdbbe0

Changes from gitlab

93b548c

JWT Auth partial implelentations

27e6199

Merge branch 'master' into simple_auth

9be4294

Added auth to resources

84999af

Merge branch 'startup_fix' into simple_auth

c9d5d6d

Auth store

d2b31f7

Added api to get token

6620022

Merge branch 'es-rest' into simple_auth

4741544

Hack for consoles history

0b4d589

Merge branch 'hazelcast-kubernetes-es-rest' into es-rest

0fdcde8

Local fix

6677d73

Working jwt header auth

33c62fc

Merge remote-tracking branch 'github/es-rest' into es-rest

70324fc

Google auth

eff4911

Merge branch 'es-rest' into simple_auth

46aff36

Refresh

07d0c48

santanusinha requested review from nitishgoyal13 and jitendradhawan April 8, 2020 22:22

santanusinha changed the title ~~Google auth and static api key auth for ingestion~~ WIP::Google auth and static api key auth for ingestion Apr 8, 2020

santanusinha and others added 9 commits April 9, 2020 11:40

Removed useless breaking dependency

75ed558

Minor cleanup

b5975b3

Merge remote-tracking branch 'github/simple_auth' into google-auth

1f7b125

Ability to set url scheme for swagger

aae17b1

Merge remote-tracking branch 'github/simple_auth' into google-auth

1b93c19

Merged docker.yml

c6af89f

Seperated authentication and authorization in two different filters

b4d7e3b

Changed default session time

9b2aae7

Merge remote-tracking branch 'github/simple_auth' into google-auth

3e7d7ba

santanusinha and others added 16 commits July 18, 2020 20:09

Merge branch 'master' into simple_auth

26daab0

Merge pull request #7 from shashikiran-tatoju/publicfoxtrot

49177c6

removed unwanted console log form function.js file

Merge pull request #327 from nitishgoyal13/master

1301cac

Bug fix n UI

Merge branch 'master' into simple_auth

6cfbbed

Version update

15315a4

Updates Hzelcast to use new aws service discovery

ca87638

Merge branch 'simple_auth' into awsecs

c61bd9e

Allowed external loading for docker file

2358e47

Remove ttl from table

cdd0ba9

Merge pull request #329 from nitishgoyal13/table-ttl-remove

882df62

Remove ttl from table

Working version of polymorphic auth

b0b2a5a

Fixed bugs in logout flow

1182a50

Fixed bugs in logout flow

a2c14e2

Created separate configs etc for different auth modes. Made auth conf…

87ada27

…ig completely optional

Trying to gix github action

7d0164b

Added central snapshots

39fc6b9

santanusinha changed the title ~~WIP::Google auth and static api key auth for ingestion~~ Google, IDMan and static api key auth Jul 28, 2021

nitishgoyal13 reviewed Aug 3, 2021

View reviewed changes

This was referenced Aug 3, 2021

Support table specific roles for non idman cases. #331

Open

Add ability to revoke/grant multiple perms in one shot #332

Open

santanusinha and others added 7 commits August 3, 2021 10:38

Addressed review comments

a30d75d

Build fix

1291a48

Merge pull request #333 from nitishgoyal13/github/simple_auth

1baab4d

Build Fix

Added more infor to README

229ccb8

Merge branch 'simple_auth' of github.com:Flipkart/foxtrot into simple…

21bc94d

…_auth

Merge branch 'simple_auth' into awsecs

ae2c7cf

Hazelcast version bump

f45f4d5

nitishgoyal13 approved these changes Jan 31, 2022

View reviewed changes

santanusinha closed this Feb 2, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Google, IDMan and static api key auth #316

Google, IDMan and static api key auth #316

santanusinha commented Apr 8, 2020

nitishgoyal13 Apr 9, 2020

santanusinha Aug 3, 2021

santanusinha Aug 3, 2021

nitishgoyal13 Aug 2, 2021

santanusinha Aug 3, 2021

santanusinha Aug 3, 2021

santanusinha Aug 3, 2021

nitishgoyal13 Aug 2, 2021

santanusinha Aug 4, 2021

nitishgoyal13 Aug 2, 2021

santanusinha Aug 4, 2021

nitishgoyal13 Aug 2, 2021

santanusinha Aug 4, 2021

nitishgoyal13 Aug 2, 2021

santanusinha Aug 3, 2021

santanusinha Aug 4, 2021

nitishgoyal13 Aug 3, 2021

santanusinha Aug 3, 2021

nitishgoyal13 Aug 3, 2021

santanusinha Aug 3, 2021

santanusinha Aug 4, 2021

nitishgoyal13 Aug 3, 2021

santanusinha Aug 3, 2021

santanusinha Aug 3, 2021

nitishgoyal13 Aug 3, 2021

santanusinha Aug 3, 2021

santanusinha commented Feb 2, 2022


		Optional<User> getUser(final String userId);

		boolean deleteUser(final String id);


		boolean deleteUser(final String id);

		boolean updateUser(final String id, UnaryOperator<User> mutator);

Google, IDMan and static api key auth #316

Google, IDMan and static api key auth #316

Conversation

santanusinha commented Apr 8, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

santanusinha commented Feb 2, 2022