feat: improve ImplicitBearerToken #698

oleobal · 2023-07-28T11:34:13Z

Description

Solve the issue of sometimes issuing tokens that are about to expire, by just issuing an new token every time and relying on feat: add Client.logout and context manager substra#381 to clean them up
Add a new server.allowImplicitLogin option, allowing node admins to disable the option altogether in order to improve security practices.
Extend /active-api-tokens -X DELETE to also be able to delete ImplicitBearerToken, adding an id field to ImplicitBearerToken for this purpose. This is to enable users to terminate their sessions, as per security recommendations (this is leveraged by feat: add Client.logout and context manager substra#381)

Closes FL-1067, FL-1140

Companion to Substra/substra-documentation#336

How has this been tested?

Tried it on my machine

Checklist

changelog was updated with notable changes
documentation was updated

linear · 2023-07-28T11:34:15Z

FL-1067 Token expired just after login with username and password

Context

On Lipome, see slack thread.

Tanguy got an error "expired token", some minutes after login in with user and password

Our interpretation of the issue:

the backend, with TOKEN_STRATEGY=reuse (which is the only setting now, the alternative strategy has been removed), will reuse tokens. This is to allow running multiple scripts each using client.login at the same time
This means the backend can give you a token that is about to expire

Specification

There are several ways around this:

issue tokens more aggressively, based on a some heuristic (time since last issuance?)
maintain several tokens at the same time

Acceptance criteria

Using client.login should give out tokens with a useful lifetime left

backend/backend/views.py

oleobal · 2023-08-08T09:58:44Z

/e2e --tests sdk,frontend

Owlfred · 2023-08-08T09:58:47Z

End to end tests: ❌ FAILURE

Jobs status:

Camelyon: ⏭️
Dispatch Jobs: ✔️
Distributed / distributed-sdk,frontend: ❌
MNIST: ⏭️
Standalone / standalone-sdk,frontend: ❌

Sorry, try again.

oleobal · 2023-08-08T10:39:28Z

/e2e --tests sdk,frontend

Owlfred · 2023-08-08T10:39:30Z

End to end tests: ✔️ SUCCESS

“Carpe diem. Seize the day, boys.” ― John Keating, Dead Poets Society

linear · 2023-08-08T14:41:40Z

FL-1140 Add logout endpoint to the backend

SdgJlbl

Thanks for the PR

SdgJlbl · 2023-08-09T08:49:03Z

backend/backend/views.py

+            tokens = model.objects.filter(id=request.GET.get("id"))
+            if len(tokens) == 1 and request.user == tokens[0].user:


Minor but if we expect only one object, or raise, get does the job

My worry is since len(tokens) == 0 is a common outcome of the above request, I'd be using exceptions for control flow.

better ask for forgiveness than permission ☯️

oleobal · 2023-08-14T09:37:52Z

Waiting for Substra/substra#381 to merge

Signed-off-by: Olivier Léobal <[email protected]>

oleobal · 2023-08-16T11:31:55Z

/e2e --tests sdk,substrafl --refs substra=feat/client-logout

Owlfred · 2023-08-16T11:31:58Z

End to end tests: ✔️ SUCCESS

Signed-off-by: Olivier Léobal <[email protected]>

oleobal · 2023-08-17T08:47:45Z

/e2e --tests sdk,substrafl --refs substra=feat/client-logout

Owlfred · 2023-08-17T08:47:47Z

End to end tests: ✔️ SUCCESS

“Carpe diem. Seize the day, boys.” ― John Keating, Dead Poets Society

### Added - New `SECRET_KEY` optional environment variable ([#671](#671)) - `/api-token-auth/` and the associated tokens can now be disabled through the `EXPIRY_TOKEN_ENABLED` environment variable and `server.allowImplicitLogin` chart value ([#698](#698)) - Tokens issued by `/api-token-auth/` can now be deleted like other API tokens, through a `DELETE` request on the `/active-api-tokens` endpoint ([#698](#698)) ### Changed - Increase the number of tasks displayable in frontend workflow [#697](#697) - BREAKING: Change the format of many API responses from `{"message":...}` to `{"detail":...}` ([#705](#705)) ### Removed - BREAKING: `SECRET_KEY_PATH` and `SECRET_KEY_LOAD_AND_STORE` environment variables ([#671](#671)) - Removed logic for storing `SECRET_KEY` at startup, in order to increase stability; it should be done at a higher level, i.e. the chart ([#671](#671)) ## Fixed - `/api-token-auth/` sometimes handing out tokens that are about to expire ([#698](#698)) Signed-off-by: Milouu <[email protected]>

github-actions bot added the documentation Improvements or additions to documentation label Jul 29, 2023

oleobal changed the title ~~fix: stop issuing old tokens~~ feat: improve ImplicitBearerToken Jul 29, 2023

oleobal force-pushed the fix/issue-old-tokens branch from 9c998ed to c0a6b5c Compare July 31, 2023 14:08

oleobal mentioned this pull request Jul 31, 2023

chore: add warning to Client.login Substra/substra#378

Merged

7 tasks

oleobal marked this pull request as ready for review August 1, 2023 09:05

oleobal requested a review from a team as a code owner August 1, 2023 09:05

oleobal force-pushed the fix/issue-old-tokens branch from a11ebc3 to 801dd21 Compare August 1, 2023 15:25

SdgJlbl reviewed Aug 2, 2023

View reviewed changes

backend/backend/views.py Show resolved Hide resolved

SdgJlbl reviewed Aug 2, 2023

View reviewed changes

backend/backend/views.py Outdated Show resolved Hide resolved

SdgJlbl reviewed Aug 2, 2023

View reviewed changes

backend/backend/views.py Show resolved Hide resolved

github-actions bot added the api label Aug 4, 2023

oleobal force-pushed the fix/issue-old-tokens branch 3 times, most recently from 798adda to 4bf67b7 Compare August 8, 2023 09:57

oleobal force-pushed the fix/issue-old-tokens branch from 4bf67b7 to 89bb9b1 Compare August 8, 2023 10:10

oleobal requested a review from SdgJlbl August 8, 2023 10:16

oleobal mentioned this pull request Aug 8, 2023

docs: add a note arguing you should generate tokens Substra/substra-documentation#336

Merged

SdgJlbl approved these changes Aug 9, 2023

View reviewed changes

oleobal mentioned this pull request Aug 9, 2023

feat: add Client.logout and context manager Substra/substra#381

Merged

7 tasks

oleobal force-pushed the fix/issue-old-tokens branch 4 times, most recently from ff22581 to 5f0590e Compare August 10, 2023 12:01

oleobal mentioned this pull request Aug 14, 2023

feat: list active user sessions Substra/substra-frontend#232

Closed

oleobal added 11 commits August 16, 2023 13:23

fix: prevent handing out tokens about to expire

ffa1aaf

Signed-off-by: Olivier Léobal <[email protected]>

add server.allowImplicitLogin option

5b8c17d

Signed-off-by: Olivier Léobal <[email protected]>

Update documentation

dea4afe

Signed-off-by: Olivier Léobal <[email protected]>

Update documentation

8b33f6b

Signed-off-by: Olivier Léobal <[email protected]>

switch to HTTP 410

a892951

Signed-off-by: Olivier Léobal <[email protected]>

Improve error when implicit login disabled

1c28679

Signed-off-by: Olivier Léobal <[email protected]>

Allow deleting ImplicitBearerTokens via the API

4d07451

Signed-off-by: Olivier Léobal <[email protected]>

Update authentication.md

d983a60

Signed-off-by: Olivier Léobal <[email protected]>

set allowImplicitLogin in skaffold

c191a22

Signed-off-by: Olivier Léobal <[email protected]>

Remove token rotation mechanism

74c4371

Signed-off-by: Olivier Léobal <[email protected]>

Update tests

dc6c3a0

Signed-off-by: Olivier Léobal <[email protected]>

oleobal force-pushed the fix/issue-old-tokens branch from 5f0590e to dc6c3a0 Compare August 16, 2023 11:31

switch allowImplicitLogin to true by default

a5a397e

Signed-off-by: Olivier Léobal <[email protected]>

oleobal merged commit 2ef40a3 into main Aug 17, 2023

oleobal deleted the fix/issue-old-tokens branch August 17, 2023 10:12

Milouu mentioned this pull request Sep 5, 2023

chore: release 0.41.0 #725

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: improve ImplicitBearerToken #698

feat: improve ImplicitBearerToken #698

oleobal commented Jul 28, 2023 •

edited

Loading

linear bot commented Jul 28, 2023

Context

Specification

Acceptance criteria

oleobal commented Aug 8, 2023

Owlfred commented Aug 8, 2023 •

edited

Loading

oleobal commented Aug 8, 2023

Owlfred commented Aug 8, 2023 •

edited

Loading

linear bot commented Aug 8, 2023

SdgJlbl left a comment

SdgJlbl Aug 9, 2023

oleobal Aug 9, 2023 •

edited

Loading

SdgJlbl Aug 9, 2023

oleobal commented Aug 14, 2023

oleobal commented Aug 16, 2023

Owlfred commented Aug 16, 2023 •

edited

Loading

oleobal commented Aug 17, 2023

Owlfred commented Aug 17, 2023 •

edited

Loading

		tokens = model.objects.filter(id=request.GET.get("id"))
		if len(tokens) == 1 and request.user == tokens[0].user:

feat: improve ImplicitBearerToken #698

feat: improve ImplicitBearerToken #698

Conversation

oleobal commented Jul 28, 2023 • edited Loading

Description

How has this been tested?

Checklist

linear bot commented Jul 28, 2023

Context

Specification

Acceptance criteria

oleobal commented Aug 8, 2023

Owlfred commented Aug 8, 2023 • edited Loading

oleobal commented Aug 8, 2023

Owlfred commented Aug 8, 2023 • edited Loading

linear bot commented Aug 8, 2023

SdgJlbl left a comment

Choose a reason for hiding this comment

SdgJlbl Aug 9, 2023

Choose a reason for hiding this comment

oleobal Aug 9, 2023 • edited Loading

Choose a reason for hiding this comment

SdgJlbl Aug 9, 2023

Choose a reason for hiding this comment

oleobal commented Aug 14, 2023

oleobal commented Aug 16, 2023

Owlfred commented Aug 16, 2023 • edited Loading

oleobal commented Aug 17, 2023

Owlfred commented Aug 17, 2023 • edited Loading

oleobal commented Jul 28, 2023 •

edited

Loading

Owlfred commented Aug 8, 2023 •

edited

Loading

Owlfred commented Aug 8, 2023 •

edited

Loading

oleobal Aug 9, 2023 •

edited

Loading

Owlfred commented Aug 16, 2023 •

edited

Loading

Owlfred commented Aug 17, 2023 •

edited

Loading