search

dapr / components-contrib

Community driven, reusable components for distributed apps
Apache License 2.0
534 stars 466 forks source link

Oauth2 Middleware scalability limit and resilience issues with code grant flow and token storage #2635

Open drewby opened 1 year ago

drewby commented 1 year ago

Expected Behavior

Oauth2 Middleware should scale to multiple instances without the use of request affinity. It should also be resilient to restarts.

Actual Behavior

Oauth2 Middleware uses in-memory session state to store information during auth code grant flow and to store the client token at the end of authorization. This requires requests to always return to the same instance of the dapr sidecar and offers no resilience in the case of a restart of the daprd instance.

Steps to Reproduce the Problem

For scale:

  1. Configure daprd with a scaled deployment, no affinity on ingress
  2. After authorization, make multiple requests
  3. Some requests will require new authentication

For resilience:

  1. Use Oauth2 component to authenticate
  2. Restart daprd
  3. Next request will require authorization

Proposals

Use cookies instead of session state to store data during auth code grant flow and the client token. Enable session state to be stored in a cache (Redis, etc).

Release Note

RELEASE NOTE: FIX Oauth2 Middleware resilient storage of client token

ItalyPaleAle commented 1 year ago

This should be a blocker to make the components stable (#2621 and #2622)

However, I don't think we should persist the tokens anywhere, as that requires a data store and to query the data store on every request.

Instead, we should issue our own JWT, which is a bearer token so can be verified by Dapr without querying a database. The JWT will contain the token issued by the OAuth2 server and will be encrypted (JWE) in case the token issued by the server contains confidential information.

ItalyPaleAle commented 1 year ago

@drewby I have a POC for the OAuth2 middleware that stores tokens in cookies self-contained. Although it works, I'm running into limitations due to the fact that Azure AD tokens can be very large. Would love your feedback too on #2963

drewby commented 1 year ago

@drewby I have a POC for the OAuth2 middleware that stores tokens in cookies self-contained. Although it works, I'm running into limitations due to the fact that Azure AD tokens can be very large. Would love your feedback too on #2963

I started to comment here and then saw your link. I will comment on the PR.

ItalyPaleAle commented 1 year ago

Final one is #2967

as for splitting, we can’t do that because the 4KB limit is per-domain.

regarding safety, the tokens are stored in cookies as encrypted JWTs

drewby commented 1 year ago

Got it. I saw my question/comment were all addressed in the PR.