Support insights device authorization flow #288
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
abellotti
force-pushed
the
support_insights_device_auth
branch
from
0a2d272 to
850ccc3
Compare
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #288 +/- ##
==========================================
- Coverage 93.73% 93.30% -0.44%
==========================================
Files 67 68 +1
Lines 2827 2927 +100
==========================================
+ Hits 2650 2731 +81
- Misses 177 196 +19 ☔ View full report in Codecov by Sentry. |
abellotti
force-pushed
the
support_insights_device_auth
branch
3 times, most recently
from
4d6ea94 to
b77e48c
Compare
|
Additional logging for Insights login and publishing. Normal output, additional Info (with -v) and Debugging (with -vv).
|
|
Adding support for staging sso server for the Device authorization workflow. SSO server defaults to |
abellotti
force-pushed
the
support_insights_device_auth
branch
8 times, most recently
from
c2c9091 to
2580ce0
Compare
abellotti
force-pushed
the
support_insights_device_auth
branch
2 times, most recently
from
deaf91d to
79b65f1
Compare
With the upcoming elimination of the basic auth authentication to Insights, we are adding support for the device authorization flow. - Remove the insight add_login cli command - Add support for the insights login cli command - Add utilities to read and write the insight's user JWT authentication token - Remove the add_login cli command tests
- Add the insights device authorization workflow - updated the insights login command to request an authorization workflow and wait for the user to login/authorize out-of-band. - fixed an issue with writing the auth token to file.
- When publishing reports to Insights, use the user's JWT authentication token for Authorization. - Properly detect missing, corrupt, invalid and expired token cases.
- Removing all references to the insights login config file and related username/password handling logic and tests.
- Updated the man page to describe the login device authorization flow and the new qpc insights login subcommands.
…shing - Improved logging for Insights login authorization and report publishing - Added both logger.info (-v) and more detailed logger.debug (-vv) messages depicting target Insights SSO and Console server as well as response errors.
- Configurable via poetry run qpc insights config --sso-host <value> - Defaults to sso.redhat.com - Can be updated to the staging sso.stage.redhat.com - Used by the device auth workflow
- Tests the new device auth workflow with insights login - Tests for Insights Auth request_auth - Tests for Insights Auth wait_for_authorization
- Support device auth workflow token timeout from the SSO server. These errors should result in the same exception we trigger upon expiration timeout checks.
- While these have not changed for a long time, it is always a good idea to fetch the device_authorization_endpoint and token_endpoint from the Keycloak OpenID well-known configuration json.
- Preferring to do a patch.object on sys.argv instead of overwriting the argument list. - Using get defaults instead of or for expires_in and interval. - Rebasing with main/updated rst manpage generation
abellotti
force-pushed
the
support_insights_device_auth
branch
from
79b65f1 to
9b29ecb
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
feat(insights): Add support for device authorization
New Insights login usage:
Insights publishing error messages:
When never logged in:
Other error messages:
Draft, things still to be done:
Other changes that will be required:
Relates to JIRA: DISCOVERY-459
https://issues.redhat.com/browse/DISCOVERY-459