Repository navigation
Machine account login - #1786
JamesDoingStuff wants to merge 5 commits into
Conversation
| } | ||
| }; | ||
|
|
||
| let client = OidcClient::from_provider_metadata( |
There was a problem hiding this comment.
This requires the client to send their secret to auth-gateway.
I would move this logic to the CLI. Let the CLI acquire the refresh_token locally on the users machine. Then send the refresh_token to the auth-gateway server. This means that we never need to see their client secret.
Auth gateway should just validate that the access token used for the request is valid.
| &token_response, | ||
| IssuerUrl::new(claims.iss) | ||
| .map_err(|_| AppError::new_500("Could not convert iss claim to URL".to_string()))?, | ||
| SubjectIdentifier::new(claims.sub), |
There was a problem hiding this comment.
If you implement the above comment (get refresh token on the client side, send the refresh_token)
Use the subject from the access_token sent with the graph QL mutation. That guarantees we are updating the database entry that belongs to the user/client that made the query.
| .bearer_auth(token.secret()) | ||
| .json(&json!({ | ||
| "client_id": args.client_id, | ||
| "client_secret": args.client_secret, |
There was a problem hiding this comment.
see comments about moving oauth dance to CLI and send token instead
AP-1378
Notes
workflows service-login --client-id <ID> --client-secret <SECRET>, which is then posted along with the user's auth token toworkflows.diamond.ac.uk/auth/client-creds. The user's token is validated, then the client creds are used to retrieve a refresh token to be stored in the database