Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

incusd: allow custom oidc scope #1112

Merged
merged 4 commits into from
Aug 17, 2024
Merged

incusd: allow custom oidc scope #1112

merged 4 commits into from
Aug 17, 2024

Conversation

james-d-elliott
Copy link
Contributor

This adds the option to customize the effective scope of authorizations via OpenID Connect 1.0.

@james-d-elliott
Copy link
Contributor Author

james-d-elliott commented Aug 12, 2024 •
edited
Loading

One key element of note. No validation exists to ensure the theoretically required scopes openid and offline_access exist. Looking for preferential direction here as it could be left to the user entirely, could be automatically added, or some validation method may exist that I'm unaware of.

I'm also unaware of the impact for the UI and related projects.

General motivations:

  • The subject is unlikely to be useful for this purpose (unless it's purely an anchor; are usernames the anchor within incus?) in the case of providers that follow the spec closely as this value must be guaranteed to be both unique and stable for a particular user. See 5.7. Claim Stability and Uniqueness.
  • The scope openid offline_access does not have access to potentially more logical claims for the username (email, preferred_username).
  • Users have started asking about this project, wanted to proactively solve potential issues from my end. I take virtually no emotional value to this PR so there's no hard feelings if this doesn't align with certain goals and you decline it or you decide to takeover this PR in some way (though I've given you edit rights).

@stgraber
Copy link
Member

Hello,

Can you edit your commit to include the required Signed-off-by line?

In general, I think it makes sense to make the OIDC scope list be configurable so we can indeed request access to additional userinfo data that can then be used alongside oidc.claim. The profile scope for preferred_username being the most likely combination.

I'd probably call it oidc.scopes and have it default to openid, offline_access. We have a convenient helper to parse those kind of comma+space separated lists. SplitNTrimSpace

@james-d-elliott
Copy link
Contributor Author

james-d-elliott commented Aug 16, 2024 •
edited
Loading

Hey thanks for the feedback. I believe I've made the requested adjustments. I'm not super familiar with the codebase so I may have missed something. I just copied previous similar additions. Also our guide for incus integration if it's of interest is here.

stgraber and others added 4 commits August 17, 2024 00:57
@stgraber
api: oidc_scopes
132545b 
Signed-off-by: Stéphane Graber <[email protected]>
@james-d-elliott @stgraber
incusd/config: Add oidc.scopes
aee99a1 
Signed-off-by: Stéphane Graber <[email protected]>
@james-d-elliott @stgraber
incusd/oidc: Add custom scopes support
83d4b67 
Signed-off-by: Stéphane Graber <[email protected]>
@stgraber
doc: Update configs
ad58f75 
Signed-off-by: Stéphane Graber <[email protected]>
@github-actions github-actions bot added Documentation Documentation needs updating API Changes to the REST API labels Aug 17, 2024
@stgraber stgraber merged commit 8356c4e into lxc:main Aug 17, 2024
30 checks passed
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Sep 23, 2024
@tmeijn
build(deps): update lxc/incus to v6.5.0
f0e0813 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [lxc/incus](https://github.com/lxc/incus) | minor | `v6.4.0` -> `v6.5.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>lxc/incus (lxc/incus)</summary>

### [`v6.5.0`](https://github.com/lxc/incus/releases/tag/v6.5.0): Incus 6.5

[Compare Source](lxc/incus@v6.4.0...v6.5.0)

### Release announcement

https://discuss.linuxcontainers.org/t/incus-6-5-has-been-released/21544

#### What's Changed

-   incus/remote/list: Add column flag  by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1101
-   Cluster group list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1102
-   Translations update from Hosted Weblate by [@&#8203;weblate](https://github.com/weblate) in lxc/incus#1105
-   client: docs improvements by [@&#8203;decentral1se](https://github.com/decentral1se) in lxc/incus#1104
-   incusd/storage: Fix UsedBy values for sub-directory volumes by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1107
-   client: fix typo by [@&#8203;decentral1se](https://github.com/decentral1se) in lxc/incus#1110
-   incusd/instance: Fix backup file locking issue by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1108
-   incusd/projects: Don't fail project creation on missing pools by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1109
-   Add support for generic PCI hotplug/hotremove by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1111
-   Translations update from Hosted Weblate by [@&#8203;weblate](https://github.com/weblate) in lxc/incus#1113
-   Operation list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1114
-   doc/firewalld: Update Docker link by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1116
-   Network zone list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1117
-   Network forward list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1118
-   Add support for manual QMP configuration by [@&#8203;bensmrs](https://github.com/bensmrs) in lxc/incus#1115
-   Translations update from Hosted Weblate by [@&#8203;weblate](https://github.com/weblate) in lxc/incus#1120
-   incusd/forknet_dhcp: Add hostname to dhcp request by [@&#8203;bketelsen](https://github.com/bketelsen) in lxc/incus#1123
-   Network list leases add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1122
-   Translations update from Hosted Weblate by [@&#8203;weblate](https://github.com/weblate) in lxc/incus#1125
-   doc: Update incus_alias.md by [@&#8203;simos](https://github.com/simos) in lxc/incus#1124
-   Network list allocations add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1126
-   Add OVN load-balancer health checks by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1127
-   Prompt for dir storage pool location by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1129
-   Network integration add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1130
-   Storage bucket list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1131
-   incusd: allow custom oidc scope by [@&#8203;james-d-elliott](https://github.com/james-d-elliott) in lxc/incus#1112
-   Storage bucket key list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1134
-   Snapshot list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1135
-   incusd/storage/lvm: Fix resize logic to conserve LV state by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1136
-   incusd/network/ovn: Set missing send_periodic field by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1138
-   Improve performance of internal profile and instance listings by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1140
-   Cluster list tokens add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1139
-   incusd/main_forknet: Tweak DHCP client to apply DNS first by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1141
-   Improvements to OVN interconnect by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1142
-   incusd/storage_volumes_state: Handle unsupported response from drivers by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1143
-   lxd-to-incus: Handle Incus socket in /run/incus/ by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1144
-   Fix OVN interconnect ECMP handling by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1145
-   OpenFGA fixes by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1146
-   Config trust list tokens add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1148
-   Network peer list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1150
-   Network load balancer list add column flag by [@&#8203;HassanAlsamahi](https://github.com/HassanAlsamahi) in lxc/incus#1151
-   Translations update from Hosted Weblate by [@&#8203;weblate](https://github.com/weblate) in lxc/incus#1152
-   doc: Update Cloud-Init User Example by [@&#8203;amayer5125](https://github.com/amayer5125) in lxc/incus#1155
-   Fix backup struct naming and swagger metadata by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1156
-   incusd/device/nic: Make burst rate dynamic for ingress traffic by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1157
-   Make OVS path configurable by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1159
-   Allow live resize of VM disks by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1158
-   incusd/network/ovn: Limit MAC_Binding explosion by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1160
-   incusd/apparmor: Don't constantly query the version and cache by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1161
-   incusd/storage/driver/dir: Don't needlessly re-apply project id on qu… by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1163
-   incusd/storage/lvm: Retry setactivation skip for busy environments by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1164
-   Add startup scriptlets by [@&#8203;bensmrs](https://github.com/bensmrs) in lxc/incus#1162
-   Bump minimum Go to 1.22 by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1165
-   Storage related fixes by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1166
-   Implement boot.autorestart by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1167
-   client: Fix error handling in push mode copy by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1168
-   incusd/network/ovn: Fix send_periodic syntax by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1169
-   Better handle cluster group validation by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1172
-   Implement LVM metadatasize configuration by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1173
-   incusd/storage/zfs: Only attempt to load the module if the tools exist by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1177
-   incusd/instance/edk2: Add Void Linux x86\_64 paths by [@&#8203;dkwo](https://github.com/dkwo) in lxc/incus#1178
-   incusd/profiles: Empty default profile on forced deletion  by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1180
-   incusd/storage/drivers/ceph: Rework parseParent by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1181
-   Revert "incusd/instance/agent-loader: Don't hardcode path" by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1182
-   Improve startup performance on busy systems by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1183
-   Various bugfixes by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1185
-   Rework PCI hotplug by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1186
-   Fix EDK2 firmware detection logic by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1187
-   incus-user: Handle deleted projects by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1190
-   OVN small additions and fixes by [@&#8203;stgraber](https://github.com/stgraber) in lxc/incus#1189

#### New Contributors

-   [@&#8203;decentral1se](https://github.com/decentral1se) made their first contribution in lxc/incus#1104
-   [@&#8203;james-d-elliott](https://github.com/james-d-elliott) made their first contribution in lxc/incus#1112
-   [@&#8203;amayer5125](https://github.com/amayer5125) made their first contribution in lxc/incus#1155
-   [@&#8203;dkwo](https://github.com/dkwo) made their first contribution in lxc/incus#1178

**Full Changelog**: lxc/incus@v6.4.0...v6.5.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@stgraber stgraber stgraber approved these changes

Assignees
No one assigned
Labels
API Changes to the REST API Documentation Documentation needs updating
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@james-d-elliott @stgraber