search

kubeguard / guard

🔑 Kubernetes Authentication & Authorization WebHook Server
https://kubeguard.dev
Apache License 2.0
593 stars 81 forks source link

Implement On-Behalf-Of (OBO) flow #236

Closed weinong closed 4 years ago

weinong commented 4 years ago
  1. On-Behalf-Of (OBO) flow is added for unmanaged kubernetes (third party, using user specified AAD applications) as well as Azure Kubernetes Service (which uses first party OBO service)
  2. Separate out the token logic from Get Group logic
  3. refactored the original login() function into client-credential flow which follows the new TokenRefresher interface

This implements #131 #235

weinong commented 4 years ago

@krdhruva @tamalsaha can you please take a look?

tamalsaha commented 4 years ago

Thank you to both of you getting this pr ready @weinong @karataliu .

Do you need to update anything in the docs? Azure docs are here: https://github.com/appscode/guard/blob/master/docs/guides/authenticator/azure.md

If the docs needs any change, can you please open a separate pr against it? Then we can cut a release.

weinong commented 4 years ago

@tamalsaha yes i will update doc in separate PR. thanks!

weinong commented 4 years ago

@tamalsaha are we OK to merge now?

tamalsaha commented 4 years ago

@weinong , all the pieces are in place. I am going to read over it over the weekend and merge it. Thank you for bearing with me.

tamalsaha commented 4 years ago

We have released https://github.com/appscode/guard/releases/tag/v0.5.0-rc.0