Closed mavenzer closed 5 months ago
Hi @mavenzer
Thank you for you feedback.
If I understand you correct, you try to create some long-term token which can be used for auth in the ODD platform.
We don't support this.
In case you want to make some Postman/M2M request you should use SESSION
Cookie.
you will receive it after successful auth.
and than you can use this SESSION
in your requests
We will try to add long-term token support in future releases. If you have any questions, feel free to ask them here.
Hi @Vladysl Thanks for the update, It would be much better/standard practice if there is some kind of Long term token that can be used for auth in the ODD's API.
I still could not use the Session as you mentioned to pass in the headers for the M2M flows. can you elaborate the process as the CLIENT_ID/scopes for the M2M is different for our case what we used for the U2M flows?
Hi @Vladysl We are cannot use SESSION as it's being restricted by policy due to security. It would be much better if we can create long-term token in ODD platform for the authentication.
Hi @mavenzer , Could you please let us know how urgently you need this? We can add an additional environment variable that should store some long-term generated token, and you should use this token in the header to perform API requests.
Thanks @Vladysl for the response, I really appreciate it. So we are in the last stages of integrating ODD to our platform and calling API endpoints with some long term token is absolutely critical for triggering the downstream automation flows. Can you please elaborate on the type of ENVIRONMENT variable that can be used as headers in api request? Does the variable comes from AUTH server or we can store it in ODD platform itself?
Right now, probably we will make a fast solution with variable like(this is a draft; more details will be in implementation):
auth.type = token
auth.token = <some_token>
And you should use
@Vladysl just asking few silly questions :
Does that mean defining the AUTH token in the deployment config itself ?
What will be the validity for these kinds and tokens and how to renew/generate a new one?
Correct me if I'm wrong this token will act as proxy for authorization of the resources in ODD ?
@mavenzer
1.Yes, you need to define it in the deployment config 2.It will depend on our realisation. We will provide token example and where you can generate it.(on case you want to renew token, you should redeploy or application)
@Vladysl Sounds perfect to me! One more question, can we pass a bearer token from the AUTH server to validate our identity ? (just curios to know!)
@mavenzer if you put it in deployment config, then yes, you can
Okay got it, but most of the Bearer token coming from AUTH server will have some validity max (30 mins to 1hrs ). It would be better if we can generate the token in ODD platform and put it the deployment Config to validate the identity of the users.
@Vladysl
Hi @mavenzer, We created minor release - v0.24.1 We added 2 env variables
auth.s2s.enabled - true/false
auth.s2s.token - <any_string>
In case, you want to perform S2S or M2M request, you need to pass
auth.s2s.enabled: true
auth.s2s.token : stringExample
and for each request provide Header 'X-API-Key: stringExample'
I am truly grateful for your assistance@Vladysl . It really solved the issues for last mile automation. Really appreciate your efforts.
I have deployed the Open Data Discovery Platform in a Kubernetes cluster and integrated MobileSSO for user authentication. I am encountering issues with specific authentication flows:
Flow 1: Machine-to-Machine (M2M) Authentication For the M2M flow, where external systems need to call ODD APIs, we generate an access token from our AUTH server and pass this token as a Bearer token in the API call. However, it seems the API does not verify the token as expected. I'm not sure how to add the CLIENT_ID and SCOPES for the M2M flow in the deployment config as the CLIENT_ID/Scope are different for U2M vs M2M flows(Since our auth server have M2M flow defined)
I am redirected to an SSO login page (https://ssobackbone.onelogin.com/login) instead of being call the API endpoint.
The OIDC config which I have defined in the ODD_PLATFORM(0.23.2)
Do we need to add the M2M client_ID and scopes in the deployment yaml?
Almost the identical thing is happening when I'm trying to call the endpoints in Postman(https://odd-platform-testingconfig-alex.com/api/namespaces?page=1&size=1`). I have used the Oauth2 as AUTH type with all the above details in the deployment config. It being redirected to the.I am redirected to an SSO login page (https://ssobackbone.onelogin.com/login) instead of being call the API endpoint.
Am i'm missing something in the deployment config or the Python code for calling the M2M flows ? Best Regards,