Per-client access token expiration #14784

liggitt · 2017-06-20T19:30:52Z

This allows overriding max access token age per OAuthClient.

https://trello.com/c/hNhBstvg

OAuthClient object gains a new field: accessTokenMaxAgeSeconds

When absent, the master-config value is used
When set to 0, tokens issued for that client do not expire
When set to a value > 0, tokens issued for that client are given the specified expiration time

liggitt · 2017-06-20T19:43:44Z

[test]

smarterclayton · 2017-06-20T19:43:54Z

pkg/oauth/server/osinserver/registrystorage/storage.go

@@ -84,6 +84,13 @@ func (w *clientWrapper) GetUserData() interface{} {
 	return w.client
 }

+func (w *clientWrapper) GetExpiration(defaultExpiration int32) int32 {
+	if w.client.AccessTokenMaxAgeSeconds != nil {


Should there be an upper bound beyond which users can't specify? Under admin control? Or can we convincingly argue that only admins should be able to edit OAuthClients?

they are admin-controlled today, especially since grant method can be set to auto accept per-client

smarterclayton · 2017-06-20T23:08:26Z

I don't ha e any objections to this.

enj · 2017-06-22T02:35:01Z

@openshift/security

enj · 2017-06-22T02:45:56Z

So I know we want most of the OAuth objects to be user managible at some point. Not sure if I would want a user to able to ever change expiration though.

enj · 2017-06-22T02:48:21Z

pkg/oauth/api/types.go

+
+	// AccessTokenMaxAgeSeconds overrides the default access token max age for tokens granted to this client.
+	// 0 means no expiration.
+	AccessTokenMaxAgeSeconds *int32


I assume max int32 in seconds fits in max int64 in nanoseconds (time.Duration).

enj · 2017-06-27T19:28:38Z

pkg/auth/oauth/handlers/authenticator.go

@@ -23,6 +24,10 @@ func NewAuthorizeAuthenticator(request authenticator.Request, handler Authentica
 	return &AuthorizeAuthenticator{request, handler, errorHandler}
 }

+type ClientExpiration interface {
+	GetExpiration(int32) int32


Is there any way to turn this into GetExpiration() int32? Taking in the default seems meh.

enj · 2017-06-28T13:48:01Z

Trello card is still in backlog so moving this to 3.7.

@pweil- I assume that is fine.

openshift-bot · 2017-07-13T04:31:37Z

Evaluated for origin test up to 6f1b7b4

openshift-bot · 2017-07-13T06:13:02Z

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pull_request_origin/3098/) (Base Commit: a108425) (PR Branch Commit: 6f1b7b4)

soltysh · 2017-08-04T10:48:30Z

/unassign

liggitt · 2017-08-24T04:33:44Z

cc @openshift/sig-security

liggitt · 2017-09-13T18:05:41Z

/retest

liggitt · 2017-09-14T03:41:07Z

@enj PTAL

enj · 2017-09-14T20:39:53Z

pkg/auth/oauth/handlers/authenticator.go

@@ -23,6 +23,13 @@ func NewAuthorizeAuthenticator(request authenticator.Request, handler Authentica
 	return &AuthorizeAuthenticator{request, handler, errorHandler}
 }

+type TokenMaxAgeSeconds interface {


I do not know if this is the best place to define this interface.

Maybe pkg/oauth/server/osinserver/interfaces.go?

I do not know if this is the best place to define this interface.

why not? this is the only place the interface is used

I was not sure if we wanted to import github.com/openshift/origin/pkg/auth/oauth/handlers in pkg/oauth/server/osinserver/registrystorage/storage.go

enj · 2017-09-14T20:40:18Z

pkg/oauth/server/osinserver/registrystorage/storage.go

@@ -82,6 +82,10 @@ func (w *clientWrapper) GetUserData() interface{} {
 	return w.client
 }

+func (w *clientWrapper) GetTokenMaxAgeSeconds() *int32 {


Need a type assertion for TokenMaxAgeSeconds interface.

enj · 2017-09-14T20:48:11Z

test/integration/oauth_expiration_test.go

+	}
+
+	// Use the server and CA info
+	anonConfig := restclient.Config{}


Use AnonymousClientConfig?

enj · 2017-09-14T20:48:47Z

test/integration/oauth_expiration_test.go

+	}
+
+	{
+		five := int32(5)


Is 5 seconds long enough for it to not flake during load?

liggitt · 2017-09-17T18:45:13Z

comments addressed, PTAL

enj · 2017-09-17T20:37:13Z

pkg/oc/cli/describe/printer.go

-	expires := created.Add(time.Duration(token.ExpiresIn) * time.Second)
+	expires := "never"
+	if token.ExpiresIn > 0 {
+		expires = created.Add(time.Duration(token.ExpiresIn) * time.Second).String()


printOAuthClient should be updated with AccessTokenMaxAgeSeconds

enj · 2017-09-17T20:38:22Z

pkg/auth/oauth/handlers/authenticator.go

@@ -23,6 +23,13 @@ func NewAuthorizeAuthenticator(request authenticator.Request, handler Authentica
 	return &AuthorizeAuthenticator{request, handler, errorHandler}
 }

+type TokenMaxAgeSeconds interface {


I was not sure if we wanted to import github.com/openshift/origin/pkg/auth/oauth/handlers in pkg/oauth/server/osinserver/registrystorage/storage.go

liggitt · 2017-09-18T17:54:18Z

I was not sure if we wanted to import github.com/openshift/origin/pkg/auth/oauth/handlers in pkg/oauth/server/osinserver/registrystorage/storage.go

I don't care for now... we can hoist the interface up to a common package and do an assertion there if it becomes an issue

enj · 2017-09-18T17:58:03Z

/lgtm

openshift-merge-robot · 2017-09-18T17:58:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enj, liggitt

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~OWNERS~~ [liggitt]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

enj · 2017-09-18T20:26:41Z

/retest

liggitt · 2017-09-18T20:59:59Z

/retest

enj · 2017-09-19T01:31:30Z

/retest

openshift-bot · 2017-09-19T10:50:51Z

/retest

Please review the full test history for this PR and help us cut down flakes.

enj · 2017-09-19T13:12:17Z

/retest

enj · 2017-09-19T13:36:51Z

Flake #15900

enj · 2017-09-19T13:37:55Z

/retest

enj · 2017-09-19T13:39:12Z

Flake #16248

openshift-bot · 2017-09-19T20:55:51Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-merge-robot · 2017-09-19T22:37:11Z

/test all [submit-queue is verifying that this PR is safe to merge]

openshift-merge-robot · 2017-09-19T23:50:38Z

Automatic merge from submit-queue (batch tested with PRs 14784, 16418, 16406, 16431, 14796)

openshift-ci-robot · 2017-09-20T00:29:24Z

@liggitt: The following test failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/openshift-jenkins/extended_conformance_install_update	`a72b77b`	link	`/test extended_conformance_install_update`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

smarterclayton reviewed Jun 20, 2017

View reviewed changes

enj reviewed Jun 22, 2017

View reviewed changes

enj reviewed Jun 27, 2017

View reviewed changes

openshift-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 27, 2017

enj added this to the 3.7.0 milestone Jun 28, 2017

openshift-bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 13, 2017

openshift-merge-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 24, 2017

openshift-merge-robot assigned soltysh and deads2k Jul 25, 2017

openshift-merge-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jul 28, 2017

openshift-ci-robot unassigned soltysh Aug 4, 2017

openshift-merge-robot added the needs-api-review label Aug 4, 2017

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 24, 2017

liggitt assigned enj and simo5 Aug 24, 2017

openshift-merge-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Aug 30, 2017

openshift-merge-robot added the needs-api-review label Sep 12, 2017

openshift-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Sep 13, 2017

enj suggested changes Sep 15, 2017

View reviewed changes

enj suggested changes Sep 17, 2017

View reviewed changes

liggitt added 2 commits September 18, 2017 13:46

Per-client access token expiration

dc0b558

Generated files

a72b77b

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 18, 2017

enj approved these changes Sep 18, 2017

View reviewed changes

enj mentioned this pull request Sep 19, 2017

hack/test-cmd.sh:114: executing 'oc new-project 'cmd-admin'' timeout #15900

Closed

openshift-merge-robot merged commit 660aa12 into openshift:master Sep 19, 2017

liggitt deleted the per-client-expiration branch September 21, 2017 21:46

Per-client access token expiration #14784

Per-client access token expiration #14784

Conversation

liggitt commented Jun 20, 2017 • edited Loading

liggitt commented Jun 20, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

smarterclayton commented Jun 20, 2017

enj commented Jun 22, 2017

enj commented Jun 22, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

enj commented Jun 28, 2017

openshift-bot commented Jul 13, 2017

openshift-bot commented Jul 13, 2017

soltysh commented Aug 4, 2017

liggitt commented Aug 24, 2017

liggitt commented Sep 13, 2017

liggitt commented Sep 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Sep 17, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Sep 18, 2017

enj commented Sep 18, 2017

openshift-merge-robot commented Sep 18, 2017

enj commented Sep 18, 2017

liggitt commented Sep 18, 2017

enj commented Sep 19, 2017

openshift-bot commented Sep 19, 2017

enj commented Sep 19, 2017

enj commented Sep 19, 2017

enj commented Sep 19, 2017

enj commented Sep 19, 2017

openshift-bot commented Sep 19, 2017

openshift-merge-robot commented Sep 19, 2017

openshift-merge-robot commented Sep 19, 2017

openshift-ci-robot commented Sep 20, 2017

liggitt commented Jun 20, 2017 •

edited

Loading