Merge pull request #13276 from stlaz/direct_oidc_config

AUTH-440: expand options for the OIDC authenticator

Author: openshift-merge-bot[bot]

cmd/bridge/config/auth/authoptions.go

@@ -8,6 +8,8 @@ import (
 	"net/url"
 	"os"
 
+	"github.com/coreos/pkg/flagutil"
+
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/client-go/rest"
 	"k8s.io/klog"
@@ -28,6 +30,8 @@ type AuthOptions struct {
 	ClientSecretFilePath string
 	CAFilePath           string
 
+	ExtraScopes flagutil.StringSliceFlag
+
 	InactivityTimeoutSeconds int
 	LogoutRedirect           string
 }
@@ -44,6 +48,8 @@ type completedOptions struct {
 	ClientSecret string
 	CAFilePath   string
 
+	ExtraScopes []string
+
 	InactivityTimeoutSeconds int
 	LogoutRedirectURL        *url.URL
 }
@@ -60,19 +66,27 @@ func (c *AuthOptions) AddFlags(fs *flag.FlagSet) {
 	fs.StringVar(&c.ClientSecretFilePath, "user-auth-oidc-client-secret-file", "", "File containing the OIDC OAuth2 Client Secret.")
 	fs.StringVar(&c.CAFilePath, "user-auth-oidc-ca-file", "", "Path to a PEM file for the OIDC/OAuth2 issuer CA.")
 
+	fs.Var(&c.ExtraScopes, "user-auth-oidc-token-scopes", "Comma-separated list of extra scopes to request ID tokens with")
+
 	fs.IntVar(&c.InactivityTimeoutSeconds, "inactivity-timeout", 0, "Number of seconds, after which user will be logged out if inactive. Ignored if less than 300 seconds (5 minutes).")
 	fs.StringVar(&c.LogoutRedirect, "user-auth-logout-redirect", "", "Optional redirect URL on logout needed for some single sign-on identity providers.")
 }
 
 func (c *AuthOptions) ApplyConfig(config *serverconfig.Auth) {
+	setIfUnset(&c.AuthType, config.AuthType)
 	setIfUnset(&c.ClientID, config.ClientID)
+	setIfUnset(&c.IssuerURL, config.OIDCIssuer)
 	setIfUnset(&c.ClientSecretFilePath, config.ClientSecretFile)
 	setIfUnset(&c.CAFilePath, config.OAuthEndpointCAFile)
 	setIfUnset(&c.LogoutRedirect, config.LogoutRedirect)
 
 	if c.InactivityTimeoutSeconds == 0 {
 		c.InactivityTimeoutSeconds = config.InactivityTimeoutSeconds
 	}
+
+	if len(c.ExtraScopes) == 0 {
+		c.ExtraScopes = config.OIDCExtraScopes
+	}
 }
 
 func (c *AuthOptions) Complete(k8sAuthType string) (*CompletedOptions, error) {
@@ -94,6 +108,7 @@ func (c *AuthOptions) Complete(k8sAuthType string) (*CompletedOptions, error) {
 		AuthType:                 c.AuthType,
 		ClientID:                 c.ClientID,
 		ClientSecret:             c.ClientSecret,
+		ExtraScopes:              c.ExtraScopes,
 		CAFilePath:               c.CAFilePath,
 		InactivityTimeoutSeconds: c.InactivityTimeoutSeconds,
 	}
@@ -155,6 +170,10 @@ func (c *AuthOptions) Validate(k8sAuthType string) []error {
 			errs = append(errs, flags.NewInvalidFlagError("user-auth-oidc-issuer-url", "cannot be used with --user-auth=\"openshift\""))
 		}
 
+		if len(c.ExtraScopes) > 0 {
+			errs = append(errs, flags.NewInvalidFlagError("user-auth-oidc-token-scopes", "cannot be used with --user-auth=\"openshift\""))
+		}
+
 	case "oidc":
 		if len(c.IssuerURL) == 0 {
 			errs = append(errs, fmt.Errorf("--user-auth-oidc-issuer-url must be set if --user-auth=oidc"))
@@ -220,20 +239,17 @@ func (c *completedOptions) getAuthenticator(
 		useSecureCookies = baseURL.Scheme == "https"
 	)
 
-	scopes := []string{"openid", "email", "profile", "groups"}
-	authSource := auth.AuthSourceTectonic
+	var scopes []string
+	authSource := auth.AuthSourceOIDC
 
 	if c.AuthType == "openshift" {
-		// Scopes come from OpenShift documentation
-		// https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/authentication_and_authorization/using-service-accounts-as-oauth-client
-		//
-		// TODO(ericchiang): Support other scopes like view only permissions.
 		scopes = []string{"user:full"}
 		authSource = auth.AuthSourceOpenShift
 
 		userAuthOIDCIssuerURL = k8sEndpoint
 	} else {
 		userAuthOIDCIssuerURL = c.IssuerURL
+		scopes = append(c.ExtraScopes, "openid")
 
 	}
 

pkg/auth/asynccache.go

@@ -0,0 +1,60 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/klog"
+)
+
+type cachingFuncType[T any] func(ctx context.Context) (T, error)
+
+type AsyncCache[T any] struct {
+	reloadPeriod time.Duration
+
+	itemRWLock  sync.RWMutex
+	cachedItem  T
+	cachingFunc cachingFuncType[T]
+}
+
+func NewAsyncCache[T any](ctx context.Context, reloadPeriod time.Duration, cachingFunc cachingFuncType[T]) (*AsyncCache[T], error) {
+	c := &AsyncCache[T]{
+		reloadPeriod: reloadPeriod,
+		itemRWLock:   sync.RWMutex{},
+		cachingFunc:  cachingFunc,
+	}
+
+	item, err := cachingFunc(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to setup an async cache - caching func returned error: %w", err)
+	}
+
+	c.cachedItem = item
+
+	return c, nil
+}
+
+func (c *AsyncCache[T]) runCache(ctx context.Context) {
+	item, err := c.cachingFunc(ctx)
+	if err != nil {
+		klog.Errorf("failed a caching attempt: %v", err)
+		return
+	}
+
+	c.itemRWLock.Lock()
+	defer c.itemRWLock.Unlock()
+	c.cachedItem = item
+}
+
+func (c *AsyncCache[T]) GetItem() T {
+	c.itemRWLock.RLock()
+	defer c.itemRWLock.RUnlock()
+	return c.cachedItem
+}
+
+func (c *AsyncCache[T]) Run(ctx context.Context) {
+	go wait.UntilWithContext(ctx, c.runCache, c.reloadPeriod)
+}