User authentication using OpenID Connect protocol #4474

VJalili · 2017-08-21T23:15:34Z

A Galaxy user should be authenticated using a trusted identity provider (e.g., Google, Microsoft, Amazon) when a verifiable identity over a standard protocol is required (e.g., access cloud-based resources such as Amazon S3).

Currently Galaxy can authenticate a user using OpenID (2.0) protocol; however, this protocol is outdated as neither major identity providers nor resource providers support it (e.g., Google suspended OpenID 2.0 support in 2016). A newer authentication protocol is called OpenID Connect which is a thin layer on top of the authorization protocol, OAuth2.0. Our initial plan was to make Galaxy an OpenID Connect-trusted identity provider. However, due to technical issues of being an identity provider, we decided to leverage third-party identity providers. In other words, we decided to act as a OpenID Connect Relying Party.

This PR implements logics of authenticating a Galaxy user leveraging authorization code flow of OpenID Connect protocol.

This implementation persists only the safe-to-store information, which are:

refresh token, which is valid/usable by only the Galaxy instance for which the token is issued.
temporary access token.
temporary identity token.
expiration date of identity and access tokens.
an anti-forgery ID issued for each authenticated Galaxy user.

To setup Galaxy for using this PR, please consider this documentation, and after you set it up, here is how you can use it.

…nt class

…missing `()`

Removed white spaces between parenthesis and arguments.

…-after-rebase # Conflicts: # lib/galaxy/config.py # lib/galaxy/dependencies/pinned-requirements.txt # lib/galaxy/model/__init__.py # lib/galaxy/model/mapping.py

martenson · 2018-03-30T19:02:59Z

the requirements handling in Galaxy's repo changed, I have a WIP for this branch to fix it but I need to know which of the requirements are used directly in this code:

oauthlib
pyjwkest
PyJWT
python-openid
requests-oauthlib
social_auth_core

VJalili · 2018-03-30T19:21:58Z

Yes, these are the requirements for this PR.

martenson · 2018-03-30T19:24:41Z

@VJalili That was not my question. I am asking which ones are used directly - as opposed to deps of deps. It seems that answer is only the social_auth_core.

VJalili · 2018-03-30T19:32:56Z

Yes, that is correct, at the moment only social_auth_core, and I might need pyjwkest and PyJWT in future.

blankenberg · 2018-04-05T13:00:21Z

lib/galaxy/model/__init__.py

+        model = cls.user_model()
+        instance = model(*args, **kwargs)
+        instance.set_password_cleartext(
+            ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16)))


Now have 2 different places in Galaxy code that generate random passwords, slightly differently. Perhaps should unify under single method.

One uses random.sample, this uses random.choice. Using .choice method is arguably better as it allows character reuse. A potential issue with SystemRandom() is 'Not available on all systems.'.

I changed SystemRandom().choice to sample.

# Conflicts: # lib/galaxy/dependencies/pinned-requirements.txt # lib/galaxy/dependencies/requirements.txt

blankenberg · 2018-04-06T19:29:22Z

lib/galaxy/model/__init__.py

+    def create_user(cls, *args, **kwargs):
+        model = cls.user_model()
+        instance = model(*args, **kwargs)
+        instance.set_password_cleartext(''.join(random.sample(string.ascii_letters + string.digits, 16)))


Whoops, maybe I wasn't clear. I was saying that using choice was more secure than sample, since it can reuse characters, the search space would be larger. So I was suggesting to use .choice, but to make a single e.g. .set_password_random() method that gets called from each place.

My misunderstanding! I created set_random_password function. I think it would be better if change other random password creations (e.g., this) to leverage this function in subsequent PRs.

nsoranzo · 2018-04-06T22:41:31Z

lib/galaxy/dependencies/pinned-requirements.txt

@@ -1 +0,0 @@
-pipfiles/default/pinned-requirements.txt


This seems a merge problem.

Am I reading it correct? it deleted one line and added a new line with the same content as the original line?

Not sure, but it looks a bit strange.

For some odd reasons, this is actually replacing a symlink with a text file containing path to the originally linked file. I fixed it; and thanks @natefoo for identifying the issue.

nsoranzo · 2018-04-06T22:50:25Z

lib/galaxy/dependencies/pipfiles/default/pinned-requirements.txt

@@ -105,6 +110,7 @@ rfc3986==1.1.0
 routes==2.4.1
 simplejson==3.13.2
 six==1.11.0
+social_auth_core==1.5.0


The new way to add dependencies is to add only the ones you directly use (which I think is just social_auth_core) to lib/galaxy/dependencies/pipfiles/default/Pipfile (without specifying a version unless needed) and run make update-dependencies to update this file (pipenv needs to be installed).

I changed it. Now I'm getting the following error, any thoughts?

Invalid requirement: 'pipfiles/default/pinned-requirements.txt' It looks like a path. Does it exist ?

When does that happen?
I'd check that lib/galaxy/dependencies/pinned-requirements.txt is a symlink to pipfiles/default/pinned-requirements.txt . You can recreate it with:

cd lib/galaxy/dependencies/ rm -f pinned-requirements.txt ln -s pipfiles/default/pinned-requirements.txt

martenson · 2018-04-11T00:04:56Z

Thank you for your work @VJalili, I think this PR is in a very good shape.

martenson · 2018-04-11T00:07:14Z

followup issue xref: #5817

VJalili · 2018-04-11T00:17:45Z

@martenson Thanks!

lib/galaxy/dependencies/pipfiles/default/Pipfile

Reintroduced (empty) by mistake in galaxyproject#4474 .

It was reintroduced (empty) by mistake in galaxyproject#4474 .

VJalili added 26 commits August 7, 2017 15:36

OAuth2.0 initial commit.

f88c8c3

Added a sample config file and its related parser and setup.

b593368

Added UserOAuth2 class to model, and defined a table in mappings.

6aa59d1

Formatting ... added an empty line between two classes.

fbb28b9

(1) added provider to the OAuth2.0 model, (2) changed endpoints,

a9ea8d5

Add migrate script for the OAuth2 table.

a66bf82

Add sample OAuth2.0 configuration file, and updated its parser.

432b551

Change endpoint: OAuth2Authenticate-> OAuth2Authentication

3a90758

Update OAuth2.0 controller.

57f5a5f

Migration: Removed nullable restriction from 3 OAuth2.0 columns.

a8705f9

Change user to user_id, & set some args optional on UserAuth2 init

5f55f56

Remove nullable restriction from some fields of galaxy_user_oauth2 table

41cc0dc

Controller now attempts re-authentication upon False reply from callback

d355108

Add an interface for IdPs, & separated Google-specific flow from pare…

2e4e28e

…nt class

Change OAuth2.0 endpoints to lower-case (was camel)

c027e31

Add a TODO comment.

2326add

Fix a bug; callback does not need to pass the provider name

7ba12a1

Fix bugs; no need to commit, access_token accessor change, and add …

7c0cc5e

…missing `()`

rename access_token to access_token_info

9dc0403

make sample OAuth2.0 endpoint lowercase, and updated a comment.

734a005

Remove a TODO on Google callback check.

64d1cd8

Updated a log message.

1481603

Added package requirements

7ae287d

Removed white spaces between parenthesis and arguments.

f622206

Rebased and merged conflicts.

bd2c30b

Removed white spaces between parenthesis and arguments.

Merge remote-tracking branch 'origin/oauth2-after-rebase' into oauth2…

e0199f2

…-after-rebase # Conflicts: # lib/galaxy/config.py # lib/galaxy/dependencies/pinned-requirements.txt # lib/galaxy/model/__init__.py # lib/galaxy/model/mapping.py

galaxybot added the triage label Aug 22, 2017

galaxybot added this to the 17.09 milestone Aug 22, 2017

VJalili added 2 commits August 21, 2017 17:13

Changed migrated code sequence number.

0e55897

Removed white space between parenthesis and arguments.

3714a92

martenson mentioned this pull request Mar 30, 2018

OIDC bugs and improvements #5817

Closed

12 tasks

blankenberg reviewed Apr 5, 2018

View reviewed changes

VJalili added 3 commits April 6, 2018 11:12

use random.sample to generate random password for a user.

5ffaf9f

Merge remote-tracking branch 'upstream/dev' into oauth2-after-rebase

259daf1

# Conflicts: # lib/galaxy/dependencies/pinned-requirements.txt # lib/galaxy/dependencies/requirements.txt

Add OIDC requirements to pipfiles/default/pinned-requirements.txt

86e13a5

blankenberg reviewed Apr 6, 2018

View reviewed changes

nsoranzo reviewed Apr 6, 2018

View reviewed changes

VJalili added 6 commits April 9, 2018 10:50

Remove changes to pinned-requirements.txt

1263161

Add PSA requirement to pipfile and run make update-dependencies.

7f1e07b

Merge remote-tracking branch 'upstream/dev' into oauth2-after-rebase

cd7e0b1

replaced pinned-requirements file with s symlink.

1ed2b8f

Add the missing pyjwkest requirement to pipfile.

00d48f0

Create set_random_password function in galaxy user.

d01be5d

martenson added area/API area/security labels Apr 11, 2018

martenson approved these changes Apr 11, 2018

View reviewed changes

martenson merged commit 484f5f6 into galaxyproject:dev Apr 11, 2018

VJalili deleted the oauth2-after-rebase branch April 11, 2018 00:17

nsoranzo reviewed Apr 11, 2018

View reviewed changes

lib/galaxy/dependencies/pipfiles/default/Pipfile Show resolved Hide resolved

martenson mentioned this pull request Apr 18, 2018

Publication of Galaxy Release v 18.05 #5779

Closed

52 tasks

nsoranzo added a commit to nsoranzo/galaxy that referenced this pull request Sep 19, 2018

Remove again lib/galaxy/dependencies/requirements.txt

6a27f9a

Reintroduced (empty) by mistake in galaxyproject#4474 .

nsoranzo added a commit to nsoranzo/galaxy that referenced this pull request Sep 19, 2018

Remove again lib/galaxy/dependencies/requirements.txt

7f38e61

It was reintroduced (empty) by mistake in galaxyproject#4474 .

hexylena pushed a commit to usegalaxy-eu/galaxy that referenced this pull request Oct 1, 2018

Remove again lib/galaxy/dependencies/requirements.txt

fc4ed89

It was reintroduced (empty) by mistake in galaxyproject#4474 .

User authentication using OpenID Connect protocol #4474

User authentication using OpenID Connect protocol #4474

Uh oh!

Conversation

VJalili commented Aug 21, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

martenson commented Mar 30, 2018

Uh oh!

VJalili commented Mar 30, 2018

Uh oh!

martenson commented Mar 30, 2018

Uh oh!

VJalili commented Mar 30, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

martenson commented Apr 11, 2018

Uh oh!

martenson commented Apr 11, 2018

Uh oh!

VJalili commented Apr 11, 2018

Uh oh!

Uh oh!

Uh oh!

VJalili commented Aug 21, 2017 •

edited

Loading