Describe the problem that is tackled in this issue
The student needs to be authenticated when using the online IDE. Especially for the exam mode, it is important that the user is not able to share his session link with someone else so that this person works in his place and attempts cheating. The VSCode plugin inside of the Online IDE needs an authentication token to access the problem statement and other components of the Artemis website.
Two problems therefore arise:
Any token/credential saved in the Theia context can leak to third-parties authorized to access the session
Without authentication in Theia, we don’t know how many users are working together and submit using a reverse-proxy-like setup.
In addition, we don't want another login process where the user has to enter his credentials again. Opening the online IDE should be seamless and provide a fast entry.
The git cloning via HTTP or SSH imposes a secondary problem. The Theia session has to be able to clone and push to the student's exercise repository. If we clone the repository with HTTP the user would have to enter his credentials again. For SSH, we would have to generate an SSH on each Online Session start-up and link its public key to Artemis.
Motivation
Describe the motivation WHY the problem needs solving. Specify the affected users/roles.
Requirements Engineering
Existing (Problematic) Solution / System
What is the current solution (if there is one)? What is the problem with the current solution?
You may include a UML Model here
Currently, Artemis uses JWT to authenticate its user. The JWT token is stored as an HTTPOnly cookie and can not be read in JS.
Even if it were not HTTPOnly, hijacking that token would not be good practice, as a token should only be used for one service and not be shared. Therefore a new token for the online IDE and for the plugin should be generated. JWT is not built to generate additional tokens seamlessly.
Proposed System
What would the ideal solution look like?
To protect a theia session and guarantee seamless authentication we would integrate OIDC into Artemis. This allows generating a new token on session start up.
Authentication users with OIDC before granting them session access generates traces at the KeyCloak OID-Provider allowing fraud detection just like the existing session monitoring
With OIDC:
1 Token in Artemis Website
1 Token in Theia for Instance Access
1 Token in VSCode Plugin for Artemis Access
For the cloning of repositories we propose a token based cloning. Theia would then be provided with such a token and the user would not have to enter his credentials again.
Open:
how to securely pass this token to theia session?
if user passes this git token to someone else, can they submit without being detected?
Requirements
Describe the Functional and Non-Functional Requirements of the feature. Stick to the INVEST methodology!
Feature Proposal
Context
Problem
The student needs to be authenticated when using the online IDE. Especially for the exam mode, it is important that the user is not able to share his session link with someone else so that this person works in his place and attempts cheating. The VSCode plugin inside of the Online IDE needs an authentication token to access the problem statement and other components of the Artemis website. Two problems therefore arise:
In addition, we don't want another login process where the user has to enter his credentials again. Opening the online IDE should be seamless and provide a fast entry.
The git cloning via HTTP or SSH imposes a secondary problem. The Theia session has to be able to clone and push to the student's exercise repository. If we clone the repository with HTTP the user would have to enter his credentials again. For SSH, we would have to generate an SSH on each Online Session start-up and link its public key to Artemis.
Motivation
Requirements Engineering
Existing (Problematic) Solution / System
Currently, Artemis uses JWT to authenticate its user. The JWT token is stored as an HTTPOnly cookie and can not be read in JS. Even if it were not HTTPOnly, hijacking that token would not be good practice, as a token should only be used for one service and not be shared. Therefore a new token for the online IDE and for the plugin should be generated. JWT is not built to generate additional tokens seamlessly.
Proposed System
To protect a theia session and guarantee seamless authentication we would integrate OIDC into Artemis. This allows generating a new token on session start up. Authentication users with OIDC before granting them session access generates traces at the KeyCloak OID-Provider allowing fraud detection just like the existing session monitoring
With OIDC:
For the cloning of repositories we propose a token based cloning. Theia would then be provided with such a token and the user would not have to enter his credentials again. Open:
Requirements