Add the option to configure redirect uri #111

philiplrb · 2019-04-02T20:58:30Z

Added support for redirect uris as described at https://developer.github.com/enterprise/2.10/apps/building-oauth-apps/authorization-options-for-oauth-apps/#redirect-urls

samrocketman

Overall, not a bad change. There's a couple of other contributions I'm going to focus on merging before getting to this one.

samrocketman · 2019-04-12T02:41:29Z

src/main/java/org/jenkinsci/plugins/GithubSecurityRealm.java

+            writer.startNode("redirectUri");
+            String redirectUriValue = DEFAULT_REDIRECT_URI;
+            if (null != realm.getRedirectUri()) {
+            		redirectUriValue = realm.getRedirectUri();


Mixing tabs and spaces. There are a couple of places in your change where this happens so I'll just comment this once.

Expanded the tabs.

samrocketman · 2019-04-12T02:42:40Z

src/main/java/org/jenkinsci/plugins/GithubSecurityRealm.java

     */
    @DataBoundConstructor
    public GithubSecurityRealm(String githubWebUri,
            String githubApiUri,
            String clientID,
            String clientSecret,
-            String oauthScopes) {
+            String oauthScopes,
+            String redirectUri) {


This may cause upgrade issues. I'm not sure just a hunch. I'll test and let you know. From what I recall it's no longer a good coding practice to modify the constructors of configuration classes. @jenkinsci/code-reviewers keep me honest!

If this needs to change, please give guidance on the approach you'd like to see.

See Constructor vs. setters. Is redirectUri a mandatory or optional parameter? If optional, it should be a @DataBoundSetter rather than a @DataBoundConstructor.

IMO, missing a test that a serialized older version deserializes into newer version with default value. Which it should looking at marshal/unmarshal.

The reason not to change the constructor is to not break deployments where jenkins instance is initialized in groovy hooks. So at least keep the old constructer signature as well.

philiplrb · 2019-05-20T20:51:07Z

@samrocketman Is there anything I can do to help get this moving? Thanks!

fred-vogt · 2019-09-08T09:41:51Z

https://issues.jenkins-ci.org/browse/JENKINS-43214

Left a comment on the issue how I think this could be used.

fred-vogt · 2019-10-04T03:13:36Z

@philiplrb I think what @samrocketman is referring to a some backwards compatible constructor overload.

johnclyde · 2020-02-02T00:53:32Z

I think you have to append the redirect_uri again in the access_token.

fred-vogt · 2020-02-27T03:53:05Z

@samrocketman @philiplrb I fixed the conflict and rebased with master here:

https://github.com/vogtech/github-oauth-plugin/tree/JENKINS-43214

Also added the old constructor back for backwards compatibility with older scripts folks might have.

I'll be testing a build of this with the following url rewriting scheme:

Github "Authorization callback URL"
https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/#redirect-urls
=> https://jenkins.<domain>/securityRealm/finishLogin

Jenkins <instance> / manage / configure global security / security realm / "Redirect URI"
=> https://jenkins.<domain>/securityRealm/finishLogin/<instance>

Where I'll have a proxy that redirects:
https://jenkins.<domain>/securityRealm/finishLogin/<instance>
to
https://jenkins-<instance>.<domain>/securityRealm/finishLogin

fred-vogt · 2020-02-27T04:01:29Z

@samrocketman @philiplrb - I noticed when running this in the Jenkins UI the link in the help popup is old:

https://developer.github.com/enterprise/2.10/apps/building-oauth-apps/authorizing-oauth-apps/

fred-vogt · 2020-02-29T07:30:17Z

@samrocketman @philiplrb - I tested Philip's PR in my AWS environment using 'API Gateway' + w/lambda.

---
swagger: "2.0"
host: "jenkins.<domain>.com"
schemes:
- "https"
paths:
  /securityRealm/finishLogin/{account}/{instance}:
    get:
      responses:
        302:
          description: "302 response"
          headers:
            Location:
              type: "string"

AWS_PROXY lambda integration:

import json
import re

from urllib.parse import urlencode

#
# Redicts: https://jenkins.<domain>.com/securityRealm/finishLogin/{account}/{instance}
#      to: https://jenkins-{instance}.{account}.<domain>.com/securityRealm/finishLogin
#

def lambda_handler(event, context):
    # /securityRealm/finishLogin/{account}/{instance}
    path = event['path']

    # ?code=...&state=...
    query_string = event['queryStringParameters']

    # extract account, instance name
    path_pattern = re.compile(r'/securityRealm\/finishLogin\/(?P<account>.+)\/(?P<instance>.+)')
    parsed = path_pattern.match(path)
    
    account = parsed.group('account')
    instance = parsed.group('instance')

    encoded_query_string = urlencode(query_string)

    # specific jenkins service instance Github OAuth callback URL
    location = f'https://jenkins-{instance}.{account}.<domain>.com/securityRealm/finishLogin?{encoded_query_string}'

    response = {
        'isBase64Encoded': False,
        'statusCode': 302,
        'headers': {
            'Location': location,
        },
        'body': '',
    }

    return response

Moofasax · 2020-10-12T20:21:44Z

Any update on merging this in? would be really nice to be able to configure the redirect_uri especially with JCasC

johnclyde · 2020-10-12T20:28:20Z

I don't remember specifically what prompted me to give up on configuring github oauth 8 months ago but I do remember that github's implementation did not behave the way I wanted it to. I think if I was trying to support multiple domains for one oauth app they basically didn't support that.

Moofasax · 2020-10-12T20:43:51Z

haha dang no worries, 8 months is a long time. it seems like the redirect_uri wasnt for multiple domains, but rather different paths behind the same domain if im reading their docs right.

Moofasax · 2021-06-28T17:33:36Z

In case this gives anyone else confidence, we have been using this PR for all our Jenkins servers for over a year now and it has been working great! Would be nice to have this PR as apart of the official, but we haven't run into any issues with it thus far!

tdaniely-dn · 2021-07-19T18:54:15Z

This is a major feature for anyone who's doing multi-master with github oauth.
What is needed to move this forward?

Moofasax · 2021-07-20T13:05:48Z

This is a major feature for anyone who's doing multi-master with github oauth.
What is needed to move this forward?

Yeah, we give a Jenkins master per dev team deployed into kubernetes, so this PR has worked great, I'm just worried about upgrading in the future haha

fred-vogt · 2021-12-25T01:51:01Z

@basil - any chance we can get this into a release eventually ?

basil · 2021-12-25T05:05:45Z

@basil - any chance we can get this into a release eventually ?

Seems reasonable enough, though I don't actually use this plugin and have no way of doing a meaningful review. If you can submit a new PR against tip-of-trunk and with this comment addressed I think that should be OK.

Add the option to configure redirect uri

91e7b7f

samrocketman reviewed Apr 12, 2019

View reviewed changes

Expand tabs to spaces

938510d

tdaniely-dn mentioned this pull request Aug 5, 2022

Add redirect_uri oauth param and configuration #198

Open

7 tasks

scurvydoggo requested a review from a team as a code owner July 31, 2023 04:02

MarkEWaite added the enhancement A new feature label Nov 1, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add the option to configure redirect uri #111

Add the option to configure redirect uri #111

philiplrb commented Apr 2, 2019

samrocketman left a comment

samrocketman Apr 12, 2019

philiplrb Apr 25, 2019

samrocketman Apr 12, 2019

philiplrb Apr 25, 2019

basil Dec 25, 2021

tdaniely-dn Dec 27, 2021

philiplrb commented May 20, 2019

fred-vogt commented Sep 8, 2019 •

edited

fred-vogt commented Oct 4, 2019 •

edited

johnclyde commented Feb 2, 2020

fred-vogt commented Feb 27, 2020 •

edited

fred-vogt commented Feb 27, 2020

fred-vogt commented Feb 29, 2020

Moofasax commented Oct 12, 2020

johnclyde commented Oct 12, 2020

Moofasax commented Oct 12, 2020

Moofasax commented Jun 28, 2021

tdaniely-dn commented Jul 19, 2021

Moofasax commented Jul 20, 2021

fred-vogt commented Dec 25, 2021

basil commented Dec 25, 2021

Add the option to configure redirect uri #111

Are you sure you want to change the base?

Add the option to configure redirect uri #111

Conversation

philiplrb commented Apr 2, 2019

samrocketman left a comment

Choose a reason for hiding this comment

samrocketman Apr 12, 2019

Choose a reason for hiding this comment

philiplrb Apr 25, 2019

Choose a reason for hiding this comment

samrocketman Apr 12, 2019

Choose a reason for hiding this comment

philiplrb Apr 25, 2019

Choose a reason for hiding this comment

basil Dec 25, 2021

Choose a reason for hiding this comment

tdaniely-dn Dec 27, 2021

Choose a reason for hiding this comment

philiplrb commented May 20, 2019

fred-vogt commented Sep 8, 2019 • edited

fred-vogt commented Oct 4, 2019 • edited

johnclyde commented Feb 2, 2020

fred-vogt commented Feb 27, 2020 • edited

fred-vogt commented Feb 27, 2020

fred-vogt commented Feb 29, 2020

Moofasax commented Oct 12, 2020

johnclyde commented Oct 12, 2020

Moofasax commented Oct 12, 2020

Moofasax commented Jun 28, 2021

tdaniely-dn commented Jul 19, 2021

Moofasax commented Jul 20, 2021

fred-vogt commented Dec 25, 2021

basil commented Dec 25, 2021

fred-vogt commented Sep 8, 2019 •

edited

fred-vogt commented Oct 4, 2019 •

edited

fred-vogt commented Feb 27, 2020 •

edited