[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host #99

antonengelhardt · 2024-09-05T21:41:44Z

Please describe your changes and why you made them

Multiple OpenID providers

the plugin can now be configured to use multiple providers for token issuing and validation
the discovery fetches all information from the configured providers, loads the jwks etc.
if there is more than one provider, then the user can select a provider to authenticate with on a dedicated page. this happens with a callback (_wasm-oidc-plugin/provider-selection?authorize_with_provider=wwu&return_to=lw), which then redirect to the authorization_endpoint, because otherwise we would not be able to know which server sent the code in the code callback.
if there is only one provider, the redirection will happen right away

Small features

configurable ticking interval (ticking_interval_in_ms)
logout path to clear cookies and end session (optional) as in feat(auth): logout route #96
get envoy request id and show it in the logs & error page when something fails Error IDs on Error Page & in Logs #101

Refactor & fixes

large refactor of the files and codebase (more to come)
fix if open id providers had the jwks_uri exposed at a different host than the openid-configuration host
get :scheme to parse url as in fix(exclude): get scheme to parse url, more debug logs and yaml fmt #98
pretty print discovery and jwks responses when log level is debug

Does this PR introduce a breaking change?

Warning

This PR introduces a breaking change:
Please see envoy.yaml for the updated config structure

TODOs

Update k8s files
Write a script to migrate config
Readme
More comments, docs and logs
Error pages in html.rs
Include fix(exclude): get scheme to parse url, more debug logs and yaml fmt #98
Include feat(auth): logout route #96

Other information and Screenshots (if appropriate)

🤫 It has darkmode

Linked

For #93

more to come

* plugin can now have more than one oidc provider * the discovery will load information from all providers * user selects the provider on an auth page if there is >1 provider * more logs * more comments TODO: * error handling * performance and linting * large refactoring to file structure This is just a POC! THIS IS A BREAKING CHANGE! Signed-off-by: Anton Engelhardt <[email protected]>

* add auth.rs for code flow * rename cookies.rs to session.rs * add pause.rs Signed-off-by: Anton Engelhardt <[email protected]>

Signed-off-by: Anton Engelhardt <[email protected]>

this avoids problems with leftover cookie parts preventing decryption

Signed-off-by: Anton Engelhardt <[email protected]>

proxy-wasm/proxy-wasm-rust-sdk#277 https://blog.rust-lang.org/2024/04/09/updates-to-rusts-wasi-targets.html Signed-off-by: Anton Engelhardt <[email protected]>

Signed-off-by: Anton Engelhardt <[email protected]>

antonengelhardt added semver:minor Release in the next minor version feature New Feature or enhancement refactor Code refactoring docs Documentation labels Sep 5, 2024

antonengelhardt self-assigned this Sep 5, 2024

antonengelhardt requested a review from miwig as a code owner September 5, 2024 21:41

antonengelhardt force-pushed the mulitple-open-id-providers branch 2 times, most recently from e6806c9 to 0d882e9 Compare September 5, 2024 22:02

This was referenced Sep 6, 2024

Rebase logout path (#96) for multiple open id providers (#99) #100

Merged

Error IDs on Error Page & in Logs #101

Open

antonengelhardt linked an issue Sep 6, 2024 that may be closed by this pull request

Multiple OIDC providers #93

Open

antonengelhardt changed the title ~~[BREAKING] feat/refactor/docs: multiple providers, large refactor~~ [BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host Sep 9, 2024

antonengelhardt force-pushed the mulitple-open-id-providers branch 2 times, most recently from 80e497e to d94b6df Compare September 9, 2024 16:00

This was linked to issues Sep 10, 2024

Error IDs on Error Page & in Logs #101

Open

Logout Route to clear cookies #94

Open

antonengelhardt force-pushed the mulitple-open-id-providers branch from 36c5896 to 818a32c Compare October 2, 2024 08:41

antonengelhardt force-pushed the mulitple-open-id-providers branch 3 times, most recently from eb3e9de to 17ac0f4 Compare October 17, 2024 15:37

This was referenced Nov 4, 2024

chore(deps): Bump regex from 1.10.5 to 1.11.1 #108

Closed

fix(exclude): get scheme to parse url, more debug logs and yaml fmt #98

Closed

feat(auth): logout route #96

Closed

antonengelhardt added 7 commits November 4, 2024 18:28

refactor: split into separate files

6e9f61b

* add auth.rs for code flow * rename cookies.rs to session.rs * add pause.rs Signed-off-by: Anton Engelhardt <[email protected]>

chore: pr template

301ba4c

Signed-off-by: Anton Engelhardt <[email protected]>

refactor: error page is now generic

7866042

Signed-off-by: Anton Engelhardt <[email protected]>

style: fmt

3315846

Signed-off-by: Anton Engelhardt <[email protected]>

style: clippy lints fixed

f36a1ba

Signed-off-by: Anton Engelhardt <[email protected]>

fix: add footer to auth page and layout fixes

74060f7

Signed-off-by: Anton Engelhardt <[email protected]>

antonengelhardt and others added 26 commits November 4, 2024 18:28

style(fmt): order modules

4c72c56

Signed-off-by: Anton Engelhardt <[email protected]>

fix(discovery): implement Display for ResolverState

b70a756

Signed-off-by: Anton Engelhardt <[email protected]>

fix(logs): pretty print discovery reponses debug logs

8b03a41

Signed-off-by: Anton Engelhardt <[email protected]>

refactor/docs: naming change, more comments and log level changes

c63bcc1

Signed-off-by: Anton Engelhardt <[email protected]>

fix(logs): lower case log

b7d4ea0

Signed-off-by: Anton Engelhardt <[email protected]>

fix(html): fixed height for all providers cards

0cfa8c9

Signed-off-by: Anton Engelhardt <[email protected]>

docs: update readme and examples with multiple providers logic

866e100

Signed-off-by: Anton Engelhardt <[email protected]>

feat(discovery): configurable ticking_interval_in_ms controls ticking

b4a5a61

Signed-off-by: Anton Engelhardt <[email protected]>

style: fmt

d68a36a

Signed-off-by: Anton Engelhardt <[email protected]>

fix(discovery): fix if host of jwks endpoint is different

b6f3a13

Signed-off-by: Anton Engelhardt <[email protected]>

fix(exclude): get scheme to parse url

5b0b1a2

Signed-off-by: Anton Engelhardt <[email protected]>

feat(errors): use envoy's request-id to log errors and show, helvetica

b520a42

Signed-off-by: Anton Engelhardt <[email protected]>

refactor: rebase logout path PR with mulitple providers PR

a5ae4be

Signed-off-by: Anton Engelhardt <[email protected]>

fix(logout): write something to clear the cookie, refactor cookie fn

8b1faf3

Signed-off-by: Anton Engelhardt <[email protected]>

feat(ci): add audit, outdated and verify-project steps

8bc79b9

Signed-off-by: Anton Engelhardt <[email protected]>

chore(deps): update envoy to 1.30

025195f

Signed-off-by: Anton Engelhardt <[email protected]>

chore(deps): update regex to 1.11 and thiserror to 1.0.64

f5073fa

Signed-off-by: Anton Engelhardt <[email protected]>

fix(ci): run test jobs more quickly

5b9dc69

Signed-off-by: Anton Engelhardt <[email protected]>

chore: add audit.toml file

a9cda9d

Signed-off-by: Anton Engelhardt <[email protected]>

fix(html): error page has dark mode now!

a9feaba

Signed-off-by: Anton Engelhardt <[email protected]>

style: use inline variables in html.rs

1f103bb

fix: store number of cookie parts in a cookie

de45f7a

this avoids problems with leftover cookie parts preventing decryption

style: use inline formatting in errors.rs

822cbfd

chore: remove dead code

43a4ce7

chore(deps): update 4 deps

bbc17e7

Signed-off-by: Anton Engelhardt <[email protected]>

refactor: wasm32-wasi renamed to wasm32-wasip1 & rust to 1.78

9c4c076

proxy-wasm/proxy-wasm-rust-sdk#277 https://blog.rust-lang.org/2024/04/09/updates-to-rusts-wasi-targets.html Signed-off-by: Anton Engelhardt <[email protected]>

antonengelhardt force-pushed the mulitple-open-id-providers branch from 55da665 to 9c4c076 Compare November 4, 2024 17:28

chore(deps): update thiserror to 1.0.68

db8f721

Signed-off-by: Anton Engelhardt <[email protected]>

antonengelhardt mentioned this pull request Nov 8, 2024

Claims parameter should be configured as a dictionary #109

Open

antonengelhardt mentioned this pull request Nov 19, 2024

refactor: wasm32-wasi renamed to wasm32-wasip1, chore(deps); rust to 1.78 #111

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host #99

[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host #99

antonengelhardt commented Sep 5, 2024 •

edited

Loading

[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host #99

Are you sure you want to change the base?

[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host #99

Conversation

antonengelhardt commented Sep 5, 2024 • edited Loading

Please describe your changes and why you made them

Multiple OpenID providers

Small features

Refactor & fixes

Does this PR introduce a breaking change?

TODOs

Other information and Screenshots (if appropriate)

🤫 It has darkmode

Linked

antonengelhardt commented Sep 5, 2024 •

edited

Loading