-
Notifications
You must be signed in to change notification settings - Fork 14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add explicit support for User/PW, client credentials and Bearer token oidc auth flows #101
Conversation
2fbd547
to
4d83f8a
Compare
f148701
to
d531a08
Compare
e3f2f1c
to
384ae0f
Compare
8a6062e
to
a3a4735
Compare
v4/weaviate/connection/rest.go
Outdated
} | ||
|
||
timeToSleep := token.Expiry.Sub(time.Now()) - time.Second/10 | ||
time.Sleep(timeToSleep) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would suggest to refactor this goroutine to use channels with ticker instead of sleep. it would make also a code a little bit more readable
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
refactored the goroutine a bit, please have another look
… oidc auth flows
Before you could use all (most?) oauth methods by creating a
oauth2.NewClient
as described in the docs. However, creating this client isn't straight forward and you need to supply configuration values that we can get automatically from the weaviate oidc configuration.(Before looking into the code I wasn't aware that this includes authentication methods other than supplying a token).
This PR adds a new
NewConfig
function, that creates an oauth2 client as part of the client configuration:NewConfig(Host string, Scheme string, AuthConfig auth.Config, Headers map[string]string)
The possibilities for auth.Config are:
auth.BearerToken{AccessToken:*token*, ExpiresIn: *seconds*, RefreshToken:*token*}
auth.ResourceOwnerPasswordFlow{Username: *user*, Password: *pw*, scope:*scopes*}
auth.ClientCredentials{ClientSecret: *secret*, scopes: *scopes*}
To get a client with authentication enabled, use:
and without:
There are tests that test authenticating with a local weaviate and WCS, Okta and Azure as authentication providers.