Bug 2026573: use rd for redirect #234

clyang82 · 2021-11-09T09:39:40Z

fixes: #232

req.RequestURI is oauth/start so there is a dead loop, because the request is from xxx/oauth/start.
It can be reproduced by entering the url xxx/oauth/sign_in or xxx/oauth/start into the browsers.

Signed-off-by: clyang82 chuyang@redhat.com

clyang82 · 2021-11-09T12:40:32Z

/retest

openshift-ci · 2021-11-26T16:10:21Z

@clyang82: This pull request references Bugzilla bug 2026573, which is invalid:

expected the bug to be open, but it isn't
expected the bug to target the "4.10.0" release, but it targets "---" instead
expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is CLOSED (NOTABUG) instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 2026573: use rd for redirect

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

s-urbaniak · 2021-11-26T16:10:27Z

/bugzilla refresh

openshift-ci · 2021-11-26T16:10:30Z

@s-urbaniak: This pull request references Bugzilla bug 2026573, which is invalid:

expected the bug to be open, but it isn't
expected the bug to target the "4.10.0" release, but it targets "---" instead
expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is CLOSED (NOTABUG) instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

clyang82 · 2021-12-02T12:22:57Z

/retest

clyang82 · 2021-12-03T01:58:20Z

/test e2e-component

clyang82 · 2021-12-03T03:30:22Z

Thanks @s-urbaniak for sharing the history for skip-provider-button fix. From this issue #18, we can see the problem is

When I set -proxy-prefix to , the authentication process works correctly. However, when I also introduce -skip-provider-button, after I perform the login (which seems to work just fine), I am redirected to a URL that omits the / portion, which fails.

For my case, I do not set -proxy-prefix so that the req.RequestURI is oauth/start it leads a dead loop. so the fix is to add fine-grained check.

s-urbaniak · 2021-12-06T08:35:43Z

oauthproxy.go

@@ -504,7 +504,7 @@ func (p *OAuthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (st
 }

 func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error) {
-	if p.SkipProviderButton {
+	if p.SkipProviderButton && p.ProxyPrefix != "/oauth" {


do you mind to add some tests here as well?

Done. Thanks.

slaskawi

LGTM, but let's give @stlaz a chance to look into this.

/lgtm
/hold

stlaz · 2021-12-06T14:53:56Z

/lgtm cancel
Pre-review: there should not be 3 commits for a single line change, especially Merge branch 'openshift:master' into redirect does not look correct.

stlaz

Could you please provide an example of a request that would loop?
Also, the explanation of this change should be included in a commit message.

Needs unit tests.

openshift-ci · 2021-12-06T15:07:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: clyang82, slaskawi
To complete the pull request process, please ask for approval from stlaz after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…and skip provider button

Signed-off-by: clyang82 <chuyang@redhat.com>

clyang82 · 2021-12-07T07:43:42Z

Could you please provide an example of a request that would loop? Also, the explanation of this change should be included in a commit message.

Does the example here help? Let me know if it is unclear. Thanks.

clyang82 · 2021-12-08T01:19:10Z

/test e2e-component

clyang82 · 2021-12-09T01:02:10Z

/test e2e-component

clyang82 · 2021-12-11T00:50:08Z

/retest

clyang82 · 2021-12-13T02:05:09Z

/retest

stlaz · 2021-12-20T08:02:30Z

The tests are failing with the proxy returning 500s, please check what's the issue and address it.

clyang82 · 2021-12-20T13:20:10Z

/retest

clyang82 · 2021-12-21T01:43:34Z

/test e2e-component

clyang82 · 2021-12-21T08:47:12Z

/retest

clyang82 · 2021-12-21T08:56:06Z

The tests are failing with the proxy returning 500s, please check what's the issue and address it.

run make test-e2e --warn-undefined-variables in local OCP 4.8, always pass.

clyang82 · 2021-12-21T09:46:02Z

/retest-required

clyang82 · 2021-12-21T13:08:23Z

/bugzilla refresh

openshift-ci · 2021-12-21T13:08:29Z

@clyang82: This pull request references Bugzilla bug 2026573, which is valid. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.10.0) matches configured target release for branch (4.10.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (ytripath@redhat.com), skipping review request.

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

stlaz · 2021-12-21T15:15:32Z

oauthproxy_test.go

+		{
+			name: "Redirect to root",
+			options: func() *Options {
+				opts := testOptions()
+				opts.SkipProviderButton = true
+				opts.ProxyPrefix = "/oauth"
+				return opts
+			},
+			requestURI: "/oauth/start",
+			expected:   "/",
+		},
+		{
+			name: "Redirect to custom uri",
+			options: func() *Options {
+				opts := testOptions()
+				opts.SkipProviderButton = true
+				opts.ProxyPrefix = "/oauth2"
+				return opts
+			},
+			requestURI: "/oauth2/start",
+			expected:   "/oauth2/start",
+		},


Why do these scenarios behave differently? Why is the /oauth-prefixed path special-cased in the code above?

/oauth is default value for ProxyPrefix. the expected redirect is /. that is our case. I have described it in the description.

/oauth2 is custom value for ProxyPrefix. Keep the behaviour as it is.

I still don't see the reason why we should treat /oauth differently than any other prefix

I do not know if my case is used by other customers. my case is using default setting with skip-provider-button=true. so it always redirects to oauth/start. it should be redirected to /. You can see there is not such fix introduced in #18 in upstream - https://github.com/bitly/oauth2_proxy/blob/fa2771998a98a5bfdfa3c3503757668ac4f1c8ec/oauthproxy.go#L422

openshift-bot · 2022-01-28T18:44:41Z

/bugzilla refresh

The requirements for Bugzilla bugs have changed (BZs linked to PRs on master branch need to target OCP 4.11), recalculating validity.

openshift-ci · 2022-01-28T18:44:45Z

@openshift-bot: This pull request references Bugzilla bug 2026573, which is invalid:

expected the bug to target the "4.11.0" release, but it targets "4.10.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/bugzilla refresh

The requirements for Bugzilla bugs have changed (BZs linked to PRs on master branch need to target OCP 4.11), recalculating validity.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

clyang82 · 2022-03-22T07:20:49Z

/bugzilla refresh

openshift-ci · 2022-03-22T07:20:53Z

@clyang82: This pull request references Bugzilla bug 2026573, which is invalid:

expected the bug to target the "4.11.0" release, but it targets "4.10.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

clyang82 · 2022-03-25T01:59:39Z

/retest

openshift-ci · 2022-03-25T02:54:50Z

@clyang82: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-component	`e105658`	link	true	`/test e2e-component`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2022-06-23T06:52:35Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

ibihim · 2022-07-04T15:34:13Z

@clyang82, as mentioned in the issue, it is a misconfiguration, please check my response on your issue: #232.

We can't just add a custom path to make your solution work in particular. We would need to add a feature flag (which defaults to turned off) and it would allow relative paths (set by rd or conservation of the relative path in the first place) on skip-provider-button=true, which seems to be the issue.

openshift-ci · 2022-07-04T15:34:21Z

@clyang82: This pull request references Bugzilla bug 2026573. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.
Warning: Failed to comment on Bugzilla bug with reason for changed state.

In response to this:

Bug 2026573: use rd for redirect

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci bot requested review from stlaz and sttts November 9, 2021 09:40

s-urbaniak changed the title ~~use rd for redirect~~ Bug 2026573: use rd for redirect Nov 26, 2021

openshift-ci bot added the bugzilla/severity-low Referenced Bugzilla bug's severity is low for the branch this PR is targeting. label Nov 26, 2021

openshift-ci bot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Nov 26, 2021

s-urbaniak reviewed Dec 6, 2021

View reviewed changes

slaskawi approved these changes Dec 6, 2021

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 6, 2021

openshift-ci bot assigned slaskawi Dec 6, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 6, 2021

openshift-ci bot assigned stlaz Dec 6, 2021

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Dec 6, 2021

stlaz suggested changes Dec 6, 2021

View reviewed changes

clyang82 force-pushed the redirect branch from 72fc1b8 to 8de0cf0 Compare December 7, 2021 01:41

set redirect to req.RequestURI if ProxyPrefix is not equal to /oauth …

bbb2516

…and skip provider button

clyang82 force-pushed the redirect branch from 8de0cf0 to bbb2516 Compare December 7, 2021 01:44

Add unit tests

e105658

Signed-off-by: clyang82 <chuyang@redhat.com>

clyang82 requested a review from stlaz December 9, 2021 01:02

openshift-ci bot added bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Dec 21, 2021

stlaz reviewed Dec 21, 2021

View reviewed changes

openshift-ci bot added bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. and removed bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Jan 28, 2022

olexii4 mentioned this pull request May 6, 2022

Fix OpenShift OAuth Proxy config eclipse-che/che-operator#1379

Merged

11 tasks

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 23, 2022

ibihim closed this Jul 4, 2022

Bug 2026573: use rd for redirect #234

Bug 2026573: use rd for redirect #234

Conversation

clyang82 commented Nov 9, 2021

clyang82 commented Nov 9, 2021

openshift-ci bot commented Nov 26, 2021

s-urbaniak commented Nov 26, 2021

openshift-ci bot commented Nov 26, 2021

clyang82 commented Dec 2, 2021

clyang82 commented Dec 3, 2021

clyang82 commented Dec 3, 2021

s-urbaniak Dec 6, 2021

Choose a reason for hiding this comment

clyang82 Dec 9, 2021

Choose a reason for hiding this comment

slaskawi left a comment

Choose a reason for hiding this comment

stlaz commented Dec 6, 2021

stlaz left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Dec 6, 2021

clyang82 commented Dec 7, 2021

clyang82 commented Dec 8, 2021

clyang82 commented Dec 9, 2021

clyang82 commented Dec 11, 2021

clyang82 commented Dec 13, 2021

stlaz commented Dec 20, 2021

clyang82 commented Dec 20, 2021

clyang82 commented Dec 21, 2021

clyang82 commented Dec 21, 2021

clyang82 commented Dec 21, 2021

clyang82 commented Dec 21, 2021

clyang82 commented Dec 21, 2021

openshift-ci bot commented Dec 21, 2021

stlaz Dec 21, 2021 • edited Loading

Choose a reason for hiding this comment

clyang82 Dec 22, 2021

Choose a reason for hiding this comment

stlaz Jan 3, 2022

Choose a reason for hiding this comment

clyang82 Jan 4, 2022

Choose a reason for hiding this comment

openshift-bot commented Jan 28, 2022

openshift-ci bot commented Jan 28, 2022

clyang82 commented Mar 22, 2022

openshift-ci bot commented Mar 22, 2022

clyang82 commented Mar 25, 2022

openshift-ci bot commented Mar 25, 2022

openshift-bot commented Jun 23, 2022

ibihim commented Jul 4, 2022 • edited Loading

openshift-ci bot commented Jul 4, 2022

stlaz Dec 21, 2021 •

edited

Loading

ibihim commented Jul 4, 2022 •

edited

Loading