[request] OAuth2 plugin #169

patolo · 2015-04-28T06:47:56Z

I guess you don't want a UI but is there any plans on Oauth2 authentication?

sonicaghi · 2015-04-28T07:17:46Z

Yes

lookfirst · 2015-04-28T16:21:55Z

dmyers · 2015-04-28T18:17:58Z

👍

PierreKircher · 2015-04-28T18:19:30Z

+1

nijikokun · 2015-04-28T19:18:11Z

Yes, OAuth is a planned and upcoming plugin.

damonpetta · 2015-04-29T12:50:33Z

+1

patolo · 2015-04-29T12:52:31Z

+1

bkleef · 2015-04-29T22:53:57Z

+1

melihmucuk · 2015-05-07T14:44:23Z

+1

orliesaurus · 2015-05-07T15:18:19Z

+1

tanaydin · 2015-05-08T12:37:19Z

+1 * 100

mtwilliams · 2015-05-14T17:57:57Z

👍

tomharper · 2015-05-15T01:28:30Z

+1

samgaw · 2015-05-17T19:58:40Z

@nijikokun Is there a timeframe on when the plugin will be released?

sonicaghi · 2015-05-17T22:05:11Z

@samgaw here the plan for the coming 0.3 https://github.com/Mashape/kong/milestones/0.3.0

sonicaghi · 2015-05-17T22:05:52Z

OAuth support in the 0.4

vnataraj · 2015-06-08T01:26:03Z

+1 and I think it'd be awesome if it supports multiple grant types(implicit, authorization code, etc)

subnetmarco · 2015-06-09T20:04:48Z

In the first implementation of the OAuth 2.0 plugin I would like to support the following grant types:

authorization_code (with support for the implicit grant)
client_credentials

And support for refresh tokens.

nijikokun · 2015-06-09T21:14:11Z

I would suggest doing the basic grant types:

Implicit (Browser enabled authentication)
Resource Owner (Device and first-party, think internal or between devices)
Authorization (Application flow)
Authorization Code (See above)
Client Credentials

subnetmarco · 2015-06-10T21:59:17Z

Here are a few considerations on this plugin and a possible implementation flow. Let's consider a typical three-legged flow:

A client application wants to access to third-party user data
The user is redirect to the third-party service to authorize the application
If not logged in, the user needs to login
After logging in, the user can authorize the client application to access his data
An authorization code is being generated, and the user is redirected to a redirect_uri
The client application reads the code, and makes a request to retrieve an access_token
The authorization code is successfully exchanged for an access_token
The client application can start making API requests on behalf of the user by passing the access_token on every request.

Here is the workflow:

Login Authentication Issue

The OAuth 2.0 plugin on Kong will store all the client applications, authorization codes and access tokens inside Kong. Kong will be the only authority storing, creating and expiring this data.

What Kong can't do is authenticate the user to make sure he's logged in, because Kong doesn't integrate with an existing Login system that the third-party service uses. This means that the third-party service needs to make sure the user is logged in before starting the OAuth authorization flow.

This also means that the authorization process needs to be implemented in the third-party service frontend (to show the page that shows which scopes to accept), and backend (to securely provision an authorization code. This are steps 2-7 in the workflow above. If the authorization service wasn't implemented this way, then any client application could issue authorization codes without effectively making sure the user is logged in (and without possibly associating any user to the final access_token.

From a technical perspective, the step 5 sends the following data to Kong:

POST /oauth2_authorization HTTP/1.1
Host: kong:8001
Accept: application/json
Content-Type: application/x-www-form-urlencoded

client_id=VALUE&response_type=code&scope=email&state=VALUE&authenticated_userid=VALUE&authenticated_username=VALUE&provisioning_key=VALUE

Parameter	Description
`client_id`	The OAuth 2.0 client ID
`response_type`	The OAuth 2.0 response type
`scope`	The OAuth 2.0 scope
`state`	The OAuth 2.0 optional state
`authenticated_userid`	The logged user ID that is authorizing the client, that will be appended in a header to the final API requests
`authenticated_username`	The optional logged in username that is authorizing the client, that will be appended in a header to the final API requests
`provisioning_key`	An unique secret key that authorizes the third-party service to provision OAuth 2.0 authorization codes on behalf of the final API on Kong

This operation returns something like:

{
    "redirect_uri": "http://some/uri?code=ao182oin1kone9ah89shdansda"
}

The redirect_uri is where the third-party service webapp will redirect the user after authorizing the application to access his data.

Every other step is a regular OAuth 2.0 flow between the client and Kong.

What the user needs to build to support OAuth ?

The login page (that he already has).
The authorization page (an HTML page - the OAuth 2.0 plugin could provide a javascript helper for building this page)
The backend flow to process the form submit, executing a POST request to Kong and redirecting the user to the redirect_uri URI if the provisioning succeeds.

Thoughts?

nijikokun · 2015-06-10T22:02:07Z

@thefosk yes this is the generally accepted method of approaching this issue

ahmadnassri · 2015-06-10T22:07:34Z

perhaps it's better to prefix this comment with clarification:

this is only the context of using Kong in-front of your web application and outsourcing the oauth authentication flow to Kong only

generally speaking, everything before step 5 Kong shouldn't care about.

step 5 is between the service provider server (Kong owner) and Kong, (creating an access token) which is then passed to the web application.

from step 6 and onwards, its communication between an application / server and Kong oauth flows directly.

so, to simplify this:

Q1: What does the Kong user needs to build to support OAuth?
A: integrate with Kong API to create authentication keys

**Q2: What does the application developer need to build to use OAuth with Kong?**A:** follow standard oauth application flows.

to that end, perhaps we should create a simple documentation to be used by Kong users to expose to their application developers (which is just the oauth2 flows spec)

sonicaghi · 2015-06-18T01:11:38Z

PR in the works here #341

samgaw · 2015-06-19T00:26:51Z

My understanding of the project's goals was to essentially glue various internal APIs and microservices together. Within the scope of that context, does it not make sense for an OAuth plugin to focus on Kong acting as the provider rather than looking at 3rd party providers beyond the edge?

ahmadnassri · 2015-06-19T01:04:25Z

@samgaw that's exactly what this plugin would be, Kong as the oAuth provider on the edge (or internal if used as such).

sonicaghi · 2015-07-18T08:47:15Z

You can find OAuth2 here: http://getkong.org/plugins/oauth2-authentication/

subnetmarco · 2015-07-23T00:05:10Z

Hey guys, the 0.4.0 is out with OAuth 2.0 plugin support (http://getkong.org/plugins/oauth2-authentication/). Try it and break it :)

samgaw · 2015-07-23T11:25:57Z

Cheers Marco. Docs look great.

I'll try setting up with a couple of different consumers over the weekend.

matthewgo · 2015-08-06T08:37:55Z

Will Resource Owner/Password Credential be implemented in the OAuth plugin in Kong?

subnetmarco · 2015-08-06T19:01:12Z

Yep, thanks for requesting it. I just opened a new issue #448.

subnetmarco · 2015-08-07T02:42:04Z

@givmefive5 it has been implemented, pushed to master, and coming up in the next version.

matthewgo · 2015-08-07T02:52:20Z

Thank you, will check it out 👍

) * chore(ci) [skip travis] move nightly releases to Jenkins * [skip travis] * [skip travis] split plugin tests out and login to docker when building the docker test image * [skip travis] try a different way of defining the KONG_VERSION env * [skip travis] skip the problematic builds * [skip travis] move the daily deploys out of travis.yml * [skip travis] wip debugging a sporadically failing test * fix(tests) adjust how we run the report mock server for a more reliable test * chore(ci) debug the environment variables available in jenkins [skip travis] * chore(ci) set the repository os name environment variable [skip travis] * test(reports) adjust how we check if the report server can run * chore(ci) adjust the jenkins setup [skip travis] * chore(wip) remove the integration tests to focus on getting the nightly releases to work * fix(ci) adjust how set set the bintray credentials [skip travis] * wip -- debugging daily releases to bintray [skip travis] * chore(ci) run only the xenial release [skip travis] * chore(ci) re-enable tests and other distribution releases * chore(ci) add the CI cron trigger chore(dependency) bump the kong-build-tools dependency (#168) chore(dependencies) adjust kong-build-tools dependency pin (#169) * chore(dependency) bump the kong-build-tools dependency * chore(ci) unpin the jenkins build from the kong-build-tools branch chore(nightly) build nightly arm release (#171) chore(ci) adjust cache settings for xenail nightly builds (#173)

### Summary #### libyaml 0.2.2 release - #95 -- build: do not install config.h - #97 -- appveyor.yml: fix Release build - #103 -- Remove unused code in yaml_document_delete - #104 -- Allow colons in plain scalars inside flow collections - #109 -- Fix comparison in tests/run-emitter.c - #117 -- Fix typo error - #119 -- The closing single quote needs to be indented... - #121 -- fix token name typos in comments - #122 -- Revert removing of open_ended after top level plain scalar - #125 -- Cherry-picks from PR 27 - #135 -- Windows/C89 compatibility - #136 -- allow override of Windows static lib name #### libyaml 0.2.3 release - #130 Fixed typo. - #144 Fix typo in comment - #140 Use pointer to const for strings that aren't/shouldn't be modified - #128 Squash a couple of warnings in example-deconstructor-alt - #151 Fix spelling for error message - #161 Make appveyor config be a hidden file - #159 Add CHANGES file - #160 Always output document end before directive (YAML 1.2 compatibility) - #162 Output document end marker after open ended scalars - #157 change cmake target name from libOFF.a to libyaml.a - #155 include/yaml.h: fix comments - #169 Fixed missing token in example - #127 Avoid recursion in the document loader. - #172 Support %YAML 1.2 directives - #66 Change dllexport controlling macro to use _WIN32

sonicaghi added the idea/new plugin [legacy] those issues belong to Kong Nation, since GitHub issues are reserved for bug reports. label Apr 28, 2015

thibaultcha changed the title ~~Oauth2~~ [request] OAuth2 plugin Apr 29, 2015

thibaultcha added the request label Apr 29, 2015

sonicaghi added this to the 0.4.0 milestone Jun 6, 2015

subnetmarco mentioned this issue Jun 19, 2015

Feature/OAuth 2.0 #341

Closed

subnetmarco closed this as completed Jun 26, 2015

thibaultcha added the oauth2 label Aug 15, 2016

hutchic mentioned this issue Nov 21, 2019

chore(ci) build nightly releases from jenkins instead of travis-ci #5243

Closed

bungle added plugins/oauth2 and removed oauth2 labels Sep 30, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[request] OAuth2 plugin #169

[request] OAuth2 plugin #169

patolo commented Apr 28, 2015

sonicaghi commented Apr 28, 2015

lookfirst commented Apr 28, 2015

dmyers commented Apr 28, 2015

PierreKircher commented Apr 28, 2015

nijikokun commented Apr 28, 2015

damonpetta commented Apr 29, 2015

patolo commented Apr 29, 2015

bkleef commented Apr 29, 2015

melihmucuk commented May 7, 2015

orliesaurus commented May 7, 2015

tanaydin commented May 8, 2015

mtwilliams commented May 14, 2015

tomharper commented May 15, 2015

samgaw commented May 17, 2015

sonicaghi commented May 17, 2015

sonicaghi commented May 17, 2015

vnataraj commented Jun 8, 2015

subnetmarco commented Jun 9, 2015

nijikokun commented Jun 9, 2015

subnetmarco commented Jun 10, 2015

nijikokun commented Jun 10, 2015

ahmadnassri commented Jun 10, 2015

sonicaghi commented Jun 18, 2015

samgaw commented Jun 19, 2015

ahmadnassri commented Jun 19, 2015

sonicaghi commented Jul 18, 2015

subnetmarco commented Jul 23, 2015

samgaw commented Jul 23, 2015

matthewgo commented Aug 6, 2015

subnetmarco commented Aug 6, 2015

subnetmarco commented Aug 7, 2015

matthewgo commented Aug 7, 2015

[request] OAuth2 plugin #169

[request] OAuth2 plugin #169

Comments

patolo commented Apr 28, 2015

sonicaghi commented Apr 28, 2015

lookfirst commented Apr 28, 2015

dmyers commented Apr 28, 2015

PierreKircher commented Apr 28, 2015

nijikokun commented Apr 28, 2015

damonpetta commented Apr 29, 2015

patolo commented Apr 29, 2015

bkleef commented Apr 29, 2015

melihmucuk commented May 7, 2015

orliesaurus commented May 7, 2015

tanaydin commented May 8, 2015

mtwilliams commented May 14, 2015

tomharper commented May 15, 2015

samgaw commented May 17, 2015

sonicaghi commented May 17, 2015

sonicaghi commented May 17, 2015

vnataraj commented Jun 8, 2015

subnetmarco commented Jun 9, 2015

nijikokun commented Jun 9, 2015

subnetmarco commented Jun 10, 2015

Login Authentication Issue

What the user needs to build to support OAuth ?

nijikokun commented Jun 10, 2015

ahmadnassri commented Jun 10, 2015

sonicaghi commented Jun 18, 2015

samgaw commented Jun 19, 2015

ahmadnassri commented Jun 19, 2015

sonicaghi commented Jul 18, 2015

subnetmarco commented Jul 23, 2015

samgaw commented Jul 23, 2015

matthewgo commented Aug 6, 2015

subnetmarco commented Aug 6, 2015

subnetmarco commented Aug 7, 2015

matthewgo commented Aug 7, 2015