Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend oidc_cli security context generator to include calls to the v2… #20851

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

LGhoull
Copy link

@LGhoull LGhoull commented Aug 14, 2024

Thank you for contributing to Harbor!

Comprehensive Summary of your change

  • Extend oidc_cli security context generator to include calls to the v2 API
  • remove idtoken security context generator
  • rename and consolidate tests and names accordingly

Id Tokens can no longer be used to authenticate against the v2 API
Instead, basic auth with the CLI secret as password must be used.

The use of the OIDC ID token as a bearer token for authentication against the API is inconvenient since the ID token is hard to get as a normal user.

Issue being fixed

Fixes #14236

Please indicate you've done the following:

  • Well Written Title and Summary of the PR
  • Label the PR as needed. "release-note/ignore-for-release, release-note/new-feature, release-note/update, release-note/enhancement, release-note/community, release-note/breaking-change, release-note/docs, release-note/infra, release-note/deprecation"
  • Accepted the DCO. Commits without the DCO will delay acceptance.
  • Made sure tests are passing and test coverage is added if needed.
  • Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

… API, remove idtoken security context generator, rename and consolidate tests and names accordingly

Signed-off-by: Fittkau Luis <[email protected]>
@LGhoull
Copy link
Author

LGhoull commented Aug 14, 2024

Definitely a breaking change, but I can't add labels.

@LGhoull LGhoull marked this pull request as ready for review August 14, 2024 12:41
@LGhoull LGhoull requested a review from a team as a code owner August 14, 2024 12:41
@reasonerjt
Copy link
Contributor

Although the change is relatively small, b/c this is a break change and involves security. I wish to suggest that a proposal is needed for review and get approval from maintainers.

If we reach a consensus to do this, there should also be some change needed in UI and Documentation.

Copy link
Contributor

@reasonerjt reasonerjt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please write a proposal and get approval first.

@LGhoull
Copy link
Author

LGhoull commented Aug 19, 2024

Proposal: goharbor/community#250

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Harbor API access via OIDC from other clients not possible
5 participants