Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for region to region system tokens for OIDC #844

Closed
jvlcek opened this issue May 21, 2020 · 2 comments
Closed

Add support for region to region system tokens for OIDC #844

jvlcek opened this issue May 21, 2020 · 2 comments
Assignees

Comments

@jvlcek
Copy link
Member

jvlcek commented May 21, 2020

When authenticating with the region to region system token, also referred to as the X-MIQ-Token, after the token is validated an attempt is made to authorize the user. This is possible when configured to use external authentication with SSSD, because dbus can be used to query the Identity Provider, but not with using OIDC, which does not use SSSD.

The issue is rooted in method: Api::BaseController::Authentication#authenticate_with_system_token

Which invokes:

       User.authorize_user(@miq_token_hash[:userid])

This approach will need to be update to not require authorizing the user when using the system token and instead perhaps saving the user's authorized group information when creating the system token.

This issue corresponds with the manageiq-api-client issue:

Need to add support for JWT authentication #91

@jvlcek
Copy link
Member Author

jvlcek commented May 21, 2020

@miq-bot assign @jvlcek
@miq-bot add_label enhancement

@jvlcek jvlcek changed the title Add support for region to region system tokens for OpenID-Connect configurations Add support for region to region system tokens for OIDC May 21, 2020
@abellotti
Copy link
Member

closing this as the API system token enhancement is already being tracked with this issue #842

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants