Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OAuth Authentication Support #146

Merged
merged 19 commits into from
May 24, 2024
Merged

OAuth Authentication Support #146

merged 19 commits into from
May 24, 2024

Conversation

sitingren
Copy link
Member

@sitingren sitingren commented May 21, 2024

  • OAuth 2.0 Support
  • Add CI test with Keycloak
  • Upgrade requested protocol version from 3.5 to 3.16, and fix test regressions
  • Enforce connection string's scheme to be vertica://, and fix test regressions

client_pid: params.client_pid
client_pid: params.client_pid,
binary_data_protocol: '0', // Defaults to text format '0'
protocol_compat: 'VER',
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For nodejs client, do we need an undocumented parameter to control whether send oauth_access_token in startup message for old servers?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since OAuth in vertica-nodejs was not supported when those old servers were released we can just say this is a new feature that works with newer server versions starting at the version where we removed access token from the startup message.

@@ -30,7 +30,7 @@ describe('vertica client label connection parameter', function () {
client_default.query('SELECT GET_CLIENT_LABEL()', (err, res) => {
if (err){
console.log(err)
assert(false)
done(err)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good clean up

assert.equal(res.rows[0].client_pid, process.pid)
assert.equal(res.rows[0].client_type, "Node.js Driver")
assert.equal(res.rows[0].client_version, vertica.version)
assert.equal(res.rows[0].client_os, os.platform())
assert.equal(res.rows[0].client_os_user_name, os.userInfo().username)
assert.equal(res.rows[0].client_os_hostname, os.hostname())
client.end()
done()
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will call the done() callback function twice now, right? Since we provided the callback to it() and also we are explicitly calling it here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not really sure how to write mocha test, I made this change because I notice if I provide invalid connection info, this test ignores the connection failure error and passes.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would expect that the explicit call to done(err) would fix that, but the extra call to done() on line 121 is probably unnecessary since the callback is provided on line 109 to the it function. . I can test it out when I play around with oauth.

@@ -7,13 +7,15 @@ var suite = new helper.Suite()
// clear process.env
var realEnv = {}
for (var key in process.env) {
realEnv[key] = process.env[key]
if (!key.indexOf('PG')) delete process.env[key]
if (key.startsWith('V_')) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch

@@ -1,5 +1,11 @@
'use strict'
require('./test-helper')
/*
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll take a look at this and log an issue if it can be removed or concatenated. This uses the homemade test infrastructure test-helper which I don't love either, so I'm all for reducing this down to one place.

@DMickens
Copy link
Collaborator

Took a first pass. It looks like a great implementation plus a lot of good clean up. I left a few comments. I'll do another more thorough review when I have enough time to test it out locally

// user is required for non-OAuth connections
this.user = val('user', config)
if (!this.user && !this.oauth_access_token) {
this.user = process.platform === 'win32' ? process.env.USERNAME : process.env.USER
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a comment here so that we will log a notice once we have that option. Something like
// TODO: log a notice to the user that the user property was taken from the environment once we fully support logging

@DMickens
Copy link
Collaborator

I added one new request for a comment. It is not a blocking concern so I will approve now. This looks great, both the new feature implementation and all of the cleanup is very nice to have.

@sitingren sitingren merged commit 7af0dd0 into vertica:master May 24, 2024
7 checks passed
@sitingren sitingren deleted the oauth branch May 24, 2024 12:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants