Configure webui login URLs and details dynamically #5093

arielshaqed · 2023-01-25T11:21:31Z

arielshaqed · 2023-01-25T16:14:07Z

Manual verifications performed:

Nothing configured in login_config, everything works normally.
OIDC configured and enabled, everything continues to work. (But this
option WILL go away shortly!)
login_config configured, all fields work. Full end-to-end tests will
have to wait until we have an alternative login controller service, but
we can already validate the UI works according to the login_config that
it receives from lakeFS.

arielshaqed · 2023-01-25T16:17:28Z

Validation with OIDC configuration

I used this configuration snippet:

  oidc:
    enabled: true
    url: https://XXX.YYY.IDP.com/   # elided
    client_id: abcdefg
    client_secret: hijklmnoprshhhhhh
    callback_base_url: http://localhost:8000/

and login still works.

arielshaqed · 2023-01-25T16:18:59Z

Validation of ui_config.login_failed_message

Added this snippet:

  ui_config:
    login_failed_message: That didn't work.  Does a link to <a href="https://cnn.com">CNN</a> work?
    # ...

Failed to login, and got a text with a link to CNN.

arielshaqed · 2023-01-25T16:22:52Z

Validation of fallback configuration

With this configuration:

  ui_config:
    fallback_login_url: https://login.example.com
    fallback_login_label: |
      Didn't work?  Maybe try SSL Stone Souper Login, "just add water  and login!"

the fallback button has the desired label and tries to redirect to the
server.

arielshaqed · 2023-01-25T16:33:32Z

Validation of login redirection

With this configuration:

  ui_config:
    login_url: https://another.example.com/go/login?secret=1234

the URL localhost:8000/auth/login?redirected=true&next=%2Frepositories
redirects to the pretend login server.

Note that it is only relevant when redirected=true; we never go directly
to a login URL. @johnnyaug amirite?

johnnyaug · 2023-01-26T10:21:50Z

Note that it is only relevant when redirected=true; we never go directly
to a login URL. @johnnyaug amirite?

@arielshaqed, Yes, this is to avoid jumping to this URL when the user explicitly navigates to the "internal" login page. It may or may not still be relevant today.

johnnyaug

Cool! Some comments, nothing major.

johnnyaug · 2023-01-26T11:37:48Z

api/swagger.yml

+          description: label to place on fallback_login_url.
+          type: string
+        login_cookies:
+          description: cookies to store JWT


Suggested change

description: cookies to store JWT

description: cookie names used to store JWT

Possibly also change the property name to login_cookie_names. Not feeling too strongly about this one.

Thanks! Done (60d1393bf9e319cdf6893ae6406a92cb7748be1f).

johnnyaug · 2023-01-26T11:43:54Z

pkg/api/controller.go

+	// TODO(ariels): Configure by c.Auth.OIDC.Enabled if set, otherwise
+	// from C.Auth.UIConfig


Seems like this TODO is already done?

johnnyaug · 2023-01-26T11:45:19Z

pkg/api/controller.go

+		defaultFallbackLoginURL   = "/oidc/login?prompt=login"
+		defaultFallbackLoginLabel = "Sign in with SSO provider"


These are only used when OIDC is enabled, so they are not really default. Can hard-code them in the if below.

Done, thanks!

johnnyaug · 2023-01-26T11:47:45Z

pkg/api/controller.go

+		cookies = c.Auth.UIConfig.LoginCookies
+		// []string{
+		// 	"internal_auth_session",
+		// }
+		loginFailedMessage = c.Auth.UIConfig.LoginFailedMessage // "The credentials don't match."
+		fallbackLoginURL   = c.Auth.UIConfig.FallbackLoginURL   // nil
+		fallbackLoginLabel = c.Auth.UIConfig.FallbackLoginLabel // nil


Are the comments here the default values? Because I don't see them set anywhere.

Thanks! Made these true defaults.

johnnyaug · 2023-01-26T11:48:35Z

webui/src/pages/auth/login.tsx

@@ -10,9 +10,18 @@ import {Error} from "../../lib/components/controls"
 import {useRouter} from "../../lib/hooks/router";
 import {useAPI} from "../../lib/hooks/api";

-const OIDC_LOGIN_URL = "/oidc/login?prompt=login";
+//const OIDC_LOGIN_URL = "/oidc/login?prompt=login";


pkg/api/controller.go

Isan-Rivkin

Nice work! left some comments, specifically regarding logout

pkg/api/controller.go

arielshaqed · 2023-02-05T10:21:30Z

Thanks!

PTAL... (Will rebase on trunk after, to keep ease of commenting on this PR)

arielshaqed

THANKS!

PTAL...

arielshaqed · 2023-02-05T10:01:10Z

api/swagger.yml

+          description: label to place on fallback_login_url.
+          type: string
+        login_cookies:
+          description: cookies to store JWT


Thanks! Done (60d1393bf9e319cdf6893ae6406a92cb7748be1f).

pkg/api/controller.go

arielshaqed · 2023-02-05T10:07:00Z

pkg/api/controller.go

+	// TODO(ariels): Configure by c.Auth.OIDC.Enabled if set, otherwise
+	// from C.Auth.UIConfig


pkg/api/controller.go

arielshaqed · 2023-02-05T10:18:36Z

pkg/api/controller.go

+		defaultFallbackLoginURL   = "/oidc/login?prompt=login"
+		defaultFallbackLoginLabel = "Sign in with SSO provider"


Done, thanks!

arielshaqed · 2023-02-05T10:18:55Z

pkg/api/controller.go

+		cookies = c.Auth.UIConfig.LoginCookies
+		// []string{
+		// 	"internal_auth_session",
+		// }
+		loginFailedMessage = c.Auth.UIConfig.LoginFailedMessage // "The credentials don't match."
+		fallbackLoginURL   = c.Auth.UIConfig.FallbackLoginURL   // nil
+		fallbackLoginLabel = c.Auth.UIConfig.FallbackLoginLabel // nil


Thanks! Made these true defaults.

pkg/api/controller.go

Isan-Rivkin

LGTM Great work!

arielshaqed · 2023-02-06T11:06:45Z

Reverify after all changes: unchecked above boxes, re-checking now before pulling.

Manual verifications performed:

Nothing configured in login_config, everything works normally.

OIDC configured and enabled, everything continues to work. (But this
option WILL go away shortly!)

login_config configured, all fields work. Full end-to-end tests will
have to wait until we have an alternative login controller service, but
we can already validate the UI works according to the login_config that
it receives from lakeFS.

arielshaqed · 2023-02-06T11:13:48Z

login_config configured, all fields work. Full end-to-end tests will
have to wait until we have an alternative login controller service, but
we can already validate the UI works according to the login_config that
it receives from lakeFS.

Everything works except for logout_url. Opening a separate issue #5195 to support that, as requirements will be part of building a complete system. @Isan-Rivkin FYI, please add a comment there about actual requirements :-)

arielshaqed · 2023-02-06T13:16:48Z

Thanks! Pulling...

Only required check not reported is license/cla. But it's me, guv, honest! So pulling by adminiforce.

arielshaqed marked this pull request as draft January 25, 2023 11:23

arielshaqed requested review from johnnyaug and Isan-Rivkin January 25, 2023 11:24

arielshaqed changed the base branch from master to chore/deprecate-oidc-login January 25, 2023 11:24

arielshaqed force-pushed the chore/deprecate-oidc-login branch from 8b620d7 to 794d435 Compare January 25, 2023 11:26

Base automatically changed from chore/deprecate-oidc-login to master January 25, 2023 11:57

arielshaqed force-pushed the feature/5085-configurable-ui-login branch 3 times, most recently from 18c2fd9 to cb70cca Compare January 25, 2023 15:39

johnnyaug approved these changes Jan 26, 2023

View reviewed changes

Isan-Rivkin requested changes Feb 2, 2023

View reviewed changes

pkg/api/controller.go Outdated Show resolved Hide resolved

pkg/api/controller.go Show resolved Hide resolved

Isan-Rivkin requested changes Feb 2, 2023

View reviewed changes

pkg/api/controller.go Show resolved Hide resolved

arielshaqed marked this pull request as ready for review February 5, 2023 10:20

arielshaqed requested a review from Isan-Rivkin February 5, 2023 10:21

arielshaqed commented Feb 5, 2023

View reviewed changes

arielshaqed added 3 commits February 5, 2023 17:47

Clean up some code in login form

117e9e4

Add UI-side configurable log{in,out} URLs and cookies

3dde0e6

Read and send SSO UI configuration from lakeFS to webui

57a0035

arielshaqed added 3 commits February 5, 2023 17:52

Refactor login_config fielf from setup state response in GUI

1416567

[CR] Rename login_cookies -> login_cookie_names

d0967a1

[CR] Set defaults properly and remove OIDC references from webui

38dd55b

arielshaqed force-pushed the feature/5085-configurable-ui-login branch from 0ecec3a to 38dd55b Compare February 5, 2023 15:52

Isan-Rivkin approved these changes Feb 6, 2023

View reviewed changes

arielshaqed added 2 commits February 6, 2023 11:41

Fix silly typo

c7442b0

make gen

c3ea3bd

arielshaqed merged commit 0e4392c into master Feb 6, 2023

arielshaqed deleted the feature/5085-configurable-ui-login branch February 6, 2023 13:17

rmoff mentioned this pull request Feb 14, 2023

Docs footer - replace Treeverse with lakeFS logo (#devex-internal/103) #5235

Merged

This was referenced Feb 22, 2023

Add mastodon icon and profile link to docs footer #5307

Merged

[DX] Web UI: Add spinner to setup screen button #5313

Merged

This was referenced Mar 6, 2023

Update/clarify S3 gateway config notes #5390

Merged

[docs] Add a little more detail to RBAC policy logic #5395

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Configure webui login URLs and details dynamically #5093

Configure webui login URLs and details dynamically #5093

arielshaqed commented Jan 25, 2023

arielshaqed commented Jan 25, 2023 •

edited

Loading

arielshaqed commented Jan 25, 2023

arielshaqed commented Jan 25, 2023

arielshaqed commented Jan 25, 2023

arielshaqed commented Jan 25, 2023 •

edited

Loading

johnnyaug commented Jan 26, 2023 •

edited

Loading

johnnyaug left a comment

johnnyaug Jan 26, 2023

johnnyaug Jan 26, 2023

arielshaqed Feb 5, 2023

johnnyaug Jan 26, 2023

arielshaqed Feb 5, 2023

johnnyaug Jan 26, 2023

arielshaqed Feb 5, 2023

johnnyaug Jan 26, 2023

arielshaqed Feb 5, 2023

johnnyaug Jan 26, 2023

Isan-Rivkin left a comment

arielshaqed commented Feb 5, 2023

arielshaqed left a comment

arielshaqed Feb 5, 2023

arielshaqed Feb 5, 2023

arielshaqed Feb 5, 2023

arielshaqed Feb 5, 2023

Isan-Rivkin left a comment

arielshaqed commented Feb 6, 2023 •

edited

Loading

arielshaqed commented Feb 6, 2023

arielshaqed commented Feb 6, 2023

	description: cookies to store JWT
	description: cookie names used to store JWT

		// TODO(ariels): Configure by c.Auth.OIDC.Enabled if set, otherwise
		// from C.Auth.UIConfig

		defaultFallbackLoginURL = "/oidc/login?prompt=login"
		defaultFallbackLoginLabel = "Sign in with SSO provider"

Configure webui login URLs and details dynamically #5093

Configure webui login URLs and details dynamically #5093

Conversation

arielshaqed commented Jan 25, 2023

arielshaqed commented Jan 25, 2023 • edited Loading

arielshaqed commented Jan 25, 2023

Validation with OIDC configuration

arielshaqed commented Jan 25, 2023

Validation of ui_config.login_failed_message

arielshaqed commented Jan 25, 2023

Validation of fallback configuration

arielshaqed commented Jan 25, 2023 • edited Loading

Validation of login redirection

johnnyaug commented Jan 26, 2023 • edited Loading

johnnyaug left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Isan-Rivkin left a comment

Choose a reason for hiding this comment

arielshaqed commented Feb 5, 2023

arielshaqed left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Isan-Rivkin left a comment

Choose a reason for hiding this comment

arielshaqed commented Feb 6, 2023 • edited Loading

arielshaqed commented Feb 6, 2023

arielshaqed commented Feb 6, 2023

arielshaqed commented Jan 25, 2023 •

edited

Loading

arielshaqed commented Jan 25, 2023 •

edited

Loading

johnnyaug commented Jan 26, 2023 •

edited

Loading

arielshaqed commented Feb 6, 2023 •

edited

Loading