add minimal apptokens feature

owncloud / ocis-charts

:chart_with_upwards_trend: Helm Charts for ownCloud's OCIS

https://owncloud.dev/ocis/deployment/kubernetes/

Apache License 2.0

48 stars 27 forks source link

add minimal apptokens feature #767

Open butonic opened 1 month ago

butonic commented 1 month ago

Fixes #707

This PR adds a minimal app tokens feature:

External services can use the bearer tokens to make requests on external endpoints, eg. to create storage spaces and manage space membership.
For security reasons, bearer tokens can only be generated by the admin on the CLI, token generation via the web api is not enabled.
Use this only for services under your control. The generated tokens are not scoped and can execute any actions permitted by the associated user.
Allow users to generate app tokens for other clients is tracked in https://github.com/owncloud/ocis/issues/7711

butonic commented 1 month ago

Are app tokens a production ready product feature nowadays?

Partly. Enabling external services to use the graph api requires a token that does not need human interaction. @tbsbdr @dragotin how do we continue with this? @wkloucek is there a way to mark a feature as experimental?

And if so, what's the reasoning behind this:

For security reasons, bearer tokens can only be generated by the admin on the CLI, token generation via the web api is not enabled.

Why would we do a hardcoded change of the oCIS product default in AUTH_APP_SKIP_USER_GROUPS_IN_TOKEN ?

I'll revert that

Why does this service need another PVC? Even if it was to store data, shouldn't it use either the micro store interface or the storage-system storage!?

🤔 hm, good point. The only implementation currently writes to disk. I'll look into a store backed implementation.

wkloucek commented 1 month ago

@wkloucek is there a way to mark a feature as experimental?

No, the oCIS chart is intended for production installations only. (with a few exceptions like IDP, IDM, NATS service. Therefore we issue scary warnings in https://github.com/owncloud/ocis-charts/blob/main/charts/ocis/templates/NOTES.txt if you use the builtin ones.)

But in general I'd like to keep out experimental stuff, since the main branch goes straight to production because of the lack of releases of the oCIS chart...

NOTE: we recently even removed the basic auth service because it is obviously not production ready.

wkloucek commented 1 month ago

From https://github.com/owncloud/ocis/issues/10292 I understood that it's not yet production ready!?

Therefore setting to draft state.

micbar commented 1 day ago

@wkloucek The productisation has happened, Ticket https://github.com/owncloud/ocis/issues/10292