Skip account-service by talking to CS3 user-api #1020
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
IljaN
force-pushed
the
skip-accounts-service
branch
2 times, most recently
from
242a2d8 to
d6114ef
Compare
|
@IljaN I read up on how to provision osixia/openldap: I'm also using an updated users.ldif file with an additional
Maybe we should add the test users from the acceptance tests? IIRC they have an ldif somewhere... |
IljaN
force-pushed
the
skip-accounts-service
branch
from
f4e8d19 to
35045ee
Compare
refs
reviewed
Dec 7, 2020
proxy/pkg/config/config.go
Outdated
| @@ -115,6 +115,7 @@ type Config struct { | |||
| PolicySelector *PolicySelector `mapstructure:"policy_selector"` | |||
| Reva Reva | |||
| PreSignedURL PreSignedURL | |||
| AccountBackendType string | |||
refs
reviewed
Dec 7, 2020
refs
reviewed
Dec 7, 2020
refs
reviewed
Dec 7, 2020
refs
reviewed
Dec 7, 2020
refs
reviewed
Dec 7, 2020
refs
reviewed
Dec 7, 2020
IljaN
force-pushed
the
skip-accounts-service
branch
from
3d44944 to
14220df
Compare
|
One NPE to go: https://drone.owncloud.com/owncloud/ocis/2047/25/4 |
|
NPE Fixed |
|
This looks promising |
|
cool! enabling / disabling users is not implemented in the reva ocs implementation ... but we are directing all ocs requests to reva, right? |
butonic
reviewed
Dec 7, 2020
|
cool! enabling / disabling users is not implemented in the reva ocs implementation ... hm the error is |
IljaN
force-pushed
the
skip-accounts-service
branch
from
5fda97d to
de15642
Compare
|
I updated the ldif files to use the RFC2307bis schema, which - while already a deprecated standard, is also used by PAM_LDAP and supported by many ldap server implementations, including AD.
then I start an ldap server in docker: provide a custom proxy.json that forwards all but the signing-key requests to reva instead of ocis ocs: finally I run ocis: While this looks wild, there are actually only two things going on:
|
IljaN
force-pushed
the
skip-accounts-service
branch
2 times, most recently
from
4017689 to
90ba75e
Compare
|
Document required ocs proxy-setting: |
|
IljaN
force-pushed
the
skip-accounts-service
branch
2 times, most recently
from
f2aeb91 to
47e10e3
Compare
IljaN
commented
Dec 10, 2020
IljaN
force-pushed
the
skip-accounts-service
branch
2 times, most recently
from
b5fc206 to
56ab680
Compare
Merged
kulmann
suggested changes
Dec 11, 2020
|
|
||
| claims.OcisID = account.Id | ||
| if err := m.validate(req); err != nil { | ||
| http.Error(w, "Invalid url signature1", http.StatusUnauthorized) |
There was a problem hiding this comment.
Suggested change
| http.Error(w, "Invalid url signature1", http.StatusUnauthorized) | |
| http.Error(w, "Invalid url signature", http.StatusUnauthorized) |
proxy/pkg/user/backend/accounts.go
Outdated
| } | ||
|
|
||
| // lazyLoadRoles adds roles from the roles-service to the user-struct by mutating an existing struct | ||
| func lazyLoadRoles(ctx context.Context, u *cs3.User, ss settings.RoleService) error { |
There was a problem hiding this comment.
Proposal for function name: injectRoles
proxy/pkg/user/backend/accounts.go
Outdated
| } | ||
|
|
||
| if !account.AccountEnabled { | ||
| // TODO: handle not found |
proxy/pkg/user/backend/cs3.go
Outdated
|
|
||
| switch { | ||
| case err != nil: | ||
| return nil, fmt.Errorf("could not authenticate with username and password user: %s", username) |
There was a problem hiding this comment.
Reminder: wrap the existing error
IljaN
force-pushed
the
skip-accounts-service
branch
from
9f25ab9 to
de6fe1d
Compare
IljaN
force-pushed
the
skip-accounts-service
branch
2 times, most recently
from
cbf807b to
a8ea665
Compare
kulmann
approved these changes
Dec 11, 2020
…rvice Configureable via: PROXY_ACCOUNT_BACKEND_TYPE=cs3 PROXY_ACCOUNT_BACKEND_TYPE=accounts (default) By using a backend which implements the CS3 user-api (currently provided by reva/storage) it is possible to bypass the ocis-accounts service and for example use ldap directly. Hides user and auth related communication behind a facade (user/backend) to minimize logic-duplication across middlewares. Allows to switich the account backend from accounts to cs3. Co-authored-by: Jörn Friedrich Dreyer <jfd@butonic.de>
This bypasses the accounts-service Co-authored-by: Willy Kloucek <wkloucek@owncloud.com>
IljaN
force-pushed
the
skip-accounts-service
branch
from
a8ea665 to
56c482c
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hides user and auth related communication behind a facade (provider/user.go) to minimize logic-duplication across middlewares. Allows to switich the account backend from accounts to cs3.
Setup for cs3
Create file ~/ldapserver/bootschema/owncloud.lidif
Create file ~/ldapserver/bootschema/users.ldif
Start ldap-server:
Modify schema and create test-users (einstein + marie)
Start ocis:
TODO: