gateway: add an authenticating reverse proxy #4876

anisometropie · 2023-08-23T16:10:42Z

Before this change, we relied on an authenticating reverse proxy called gateway. It's been in use since the inception of the project, as part of a package of services we got from SNCF Réseau.

The front-end was responsible for authenticating with keycloak, and providing a Bearer token for the reverse proxy to check.

This change introduces an authenticating reverse proxy, which replaces the previous gateway.
The front-end now entirely delegates authentication to the backend.

On startup, gateway/auth/login is called, which either returns an username
if the client is authenticated, or a redirection URL if the user needs to log in.

There are three authentication backends supported by the new gateway:

A default mock backend, which return all users to be authentificated with the same
username
An OpenID Connect backend, which is used to authenticate interactive users.
The application does not support session refresh, and does not forward logout events to the
identity provider.
A static Bearer token backend, which is not meant to be used by interactive users

Fixes #1524
Fixes #2349
Fixes #5339

codecov · 2023-09-05T23:18:18Z

Codecov Report

Attention: 868 lines in your changes are missing coverage. Please review.

Comparison is base (cbc28f5) 19.58% compared to head (727b03f) 19.46%.
Report is 4 commits behind head on dev.

Files	Patch %	Lines
gateway/actix_auth/src/auth_context.rs	0.00%	141 Missing ⚠️
gateway/actix_proxy/src/lib.rs	0.00%	141 Missing ⚠️
gateway/actix_auth/src/providers/oidc.rs	0.00%	98 Missing ⚠️
gateway/src/config_parser.rs	0.00%	88 Missing ⚠️
gateway/actix_proxy/src/websocket.rs	0.00%	53 Missing ⚠️
gateway/src/main.rs	0.00%	42 Missing ⚠️
front/src/utils/hooks/OsrdAuth.ts	0.00%	35 Missing and 1 partial ⚠️
...teway/actix_auth/src/providers/provider_context.rs	0.00%	35 Missing ⚠️
gateway/actix_auth/src/service.rs	0.00%	33 Missing ⚠️
gateway/actix_auth/src/dyn_session_provider.rs	0.00%	31 Missing ⚠️
... and 26 more

Additional details and impacted files

@@             Coverage Diff              @@
##                dev    #4876      +/-   ##
============================================
- Coverage     19.58%   19.46%   -0.12%     
  Complexity     2326     2326              
============================================
  Files           886      907      +21     
  Lines        106098   106817     +719     
  Branches       2576     2579       +3     
============================================
+ Hits          20777    20796      +19     
- Misses        83812    84509     +697     
- Partials       1509     1512       +3

Flag	Coverage Δ
editoast	`68.15% <ø> (ø)`
front	`8.33% <56.10%> (+<0.01%)`	⬆️
gateway	`2.58% <2.58%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

flomonster

Here is an intermediate review.

editoast/src/main.rs

editoast/src/client/mod.rs

editoast/src/main.rs

bloussou

Refresh is impossible in the front when you are not on the base url

docker-compose-host.yml

bloussou · 2023-11-09T13:24:38Z

We should add a /health endpoint

flomonster

Very impressive PR. Thanks!
Note: Reviewed and tested with different config files on NixOS.

gateway/src/config.rs

gateway/actix_proxy/src/lib.rs

clarani

Reviewed all the code in /front, I still need to test but it will wait till Monday :) Left 2 small comments !

front/docker/dev-entrypoint.sh

front/src/utils/hooks/OsrdAuth.ts

alexandredamiron

gateway timeout results in 500. 5s should ne be enough for multiple configurations

clarani

LGTM, tested in local (with docker and with the front+gateway+editoast in local) ✅

Castavo

I tested it while running all services locally, the proxy works fine !

When running with the mock auth provider, I can't logout from the front however, I get [2023-11-14T16:48:50Z WARN actix_proxy] proxy: error forwarding request: authentication required

gateway/src/config.rs

gateway/src/main.rs

gateway/README.md

gateway/actix_auth/src/gate_middleware.rs

leovalais

Tested on mac arm using Safari and Chrome, both locally and with docker.

Before this change, we relied on an authenticating reverse proxy called gateway. It's been in use since the inception of the project, as part of a package of services we got from SNCF Réseau. The front-end was responsible for authenticating with keycloak, and providing a Bearer token for the reverse proxy to check. This change introduces an authenticating reverse proxy, which replaces the previous gateway. The front-end now entirely delegates authentication to the backend. On startup, gateway/auth/login is called, which either returns an username if the client is authenticated, or a redirection URL if the user needs to log in. There are three authentication backends supported by the new gateway: - A default mock backend, which return all users to be authentificated with the same username - An OpenID Connect backend, which is used to authenticate interactive users. The application does not support session refresh, and does not forward logout events to the identity provider. - A static Bearer token backend, which is not meant to be used by interactive users This change also introduces unstable builds, which are pushed to ghcr.io. Co-Authored-By: Valentin Chanas <[email protected]> Co-Authored-By: =?UTF-8?q?=C3=89lys=C3=A6?= <[email protected]>

anisometropie force-pushed the vcs/oidc-editoast branch from e752721 to fb47cd1 Compare August 24, 2023 13:48

anisometropie force-pushed the vcs/oidc-editoast branch 3 times, most recently from ca804fb to dd2d73c Compare September 5, 2023 23:06

flomonster reviewed Sep 6, 2023

View reviewed changes

editoast/src/main.rs Outdated Show resolved Hide resolved

editoast/src/main.rs Outdated Show resolved Hide resolved

editoast/src/main.rs Outdated Show resolved Hide resolved

editoast/src/main.rs Outdated Show resolved Hide resolved

editoast/src/main.rs Outdated Show resolved Hide resolved

anisometropie force-pushed the vcs/oidc-editoast branch 4 times, most recently from ea49934 to 037d31d Compare September 11, 2023 16:23

anisometropie marked this pull request as ready for review September 11, 2023 21:13

anisometropie requested review from a team as code owners September 11, 2023 21:13

flomonster reviewed Sep 12, 2023

View reviewed changes

alexandredamiron assigned Math-R and multun Sep 13, 2023

multun changed the title ~~Vcs/OIDC editoast~~ editoast: add OIDC support Sep 13, 2023

alexandredamiron unassigned multun and Math-R Sep 13, 2023

alexandredamiron requested review from multun and Math-R September 13, 2023 09:35

anisometropie force-pushed the vcs/oidc-editoast branch 6 times, most recently from 9f8c6a1 to 93221a0 Compare September 20, 2023 13:27

anisometropie force-pushed the vcs/oidc-editoast branch from d89cb9d to 7a8ed49 Compare October 3, 2023 11:28

multun force-pushed the vcs/oidc-editoast branch from 7a8ed49 to 04ebbb9 Compare October 3, 2023 11:52

multun force-pushed the vcs/oidc-editoast branch from 334ad70 to 05fe267 Compare November 8, 2023 16:14

bloussou force-pushed the vcs/oidc-editoast branch from 4b9fcd9 to 3d41e4d Compare November 9, 2023 10:57

bloussou requested changes Nov 9, 2023

View reviewed changes

docker-compose-host.yml Outdated Show resolved Hide resolved

multun force-pushed the vcs/oidc-editoast branch from 7fa74d2 to cab9177 Compare November 9, 2023 15:23

flomonster approved these changes Nov 10, 2023

View reviewed changes

gateway/src/config.rs Show resolved Hide resolved

gateway/src/config.rs Outdated Show resolved Hide resolved

gateway/src/config.rs Outdated Show resolved Hide resolved

gateway/actix_proxy/src/lib.rs Outdated Show resolved Hide resolved

ElysaSrc requested a review from bloussou November 10, 2023 09:53

multun force-pushed the vcs/oidc-editoast branch from 3c5a098 to 457916e Compare November 10, 2023 11:21

clarani reviewed Nov 10, 2023

View reviewed changes

front/docker/dev-entrypoint.sh Outdated Show resolved Hide resolved

front/src/utils/hooks/OsrdAuth.ts Outdated Show resolved Hide resolved

alexandredamiron suggested changes Nov 10, 2023

View reviewed changes

multun requested review from alexandredamiron and clarani November 10, 2023 21:11

clarani approved these changes Nov 13, 2023

View reviewed changes

Castavo reviewed Nov 14, 2023

View reviewed changes

gateway/src/config.rs Outdated Show resolved Hide resolved

gateway/src/main.rs Outdated Show resolved Hide resolved

gateway/README.md Outdated Show resolved Hide resolved

gateway/actix_auth/src/gate_middleware.rs Outdated Show resolved Hide resolved

leovalais approved these changes Nov 15, 2023

View reviewed changes

multun force-pushed the vcs/oidc-editoast branch 11 times, most recently from e155a35 to 5e93dd9 Compare November 16, 2023 22:33

multun force-pushed the vcs/oidc-editoast branch from 5e93dd9 to 727b03f Compare November 17, 2023 09:38

multun merged commit 04b37b1 into dev Nov 17, 2023
14 checks passed

multun deleted the vcs/oidc-editoast branch November 17, 2023 14:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gateway: add an authenticating reverse proxy #4876

gateway: add an authenticating reverse proxy #4876

anisometropie commented Aug 23, 2023 •

edited by multun

Loading

codecov bot commented Sep 5, 2023 •

edited

Loading

flomonster left a comment

bloussou left a comment

bloussou commented Nov 9, 2023

flomonster left a comment •

edited

Loading

clarani left a comment

alexandredamiron left a comment

clarani left a comment

Castavo left a comment

leovalais left a comment

gateway: add an authenticating reverse proxy #4876

gateway: add an authenticating reverse proxy #4876

Conversation

anisometropie commented Aug 23, 2023 • edited by multun Loading

codecov bot commented Sep 5, 2023 • edited Loading

Codecov Report

flomonster left a comment

Choose a reason for hiding this comment

bloussou left a comment

Choose a reason for hiding this comment

bloussou commented Nov 9, 2023

flomonster left a comment • edited Loading

Choose a reason for hiding this comment

clarani left a comment

Choose a reason for hiding this comment

alexandredamiron left a comment

Choose a reason for hiding this comment

clarani left a comment

Choose a reason for hiding this comment

Castavo left a comment

Choose a reason for hiding this comment

leovalais left a comment

Choose a reason for hiding this comment

anisometropie commented Aug 23, 2023 •

edited by multun

Loading

codecov bot commented Sep 5, 2023 •

edited

Loading

flomonster left a comment •

edited

Loading