search

runatlantis / atlantis

Terraform Pull Request Automation
https://www.runatlantis.io
Other
7.73k stars 1.05k forks source link

OAuth login for Atlantis UI #596

Open chenrui333 opened 5 years ago

chenrui333 commented 5 years ago

Similar to #49, but I would be great to generalize the OAuth authentication support. Right now we are extensively using Google Login authentication for our tools like, Jenkins, Airflow

lkysow commented 5 years ago

Hey, can you add more information as to why this is a different request from #49?

chenrui333 commented 5 years ago

Hi @lkysow, it is different request in terms of security implementation details. I think github is just one of the OAuth provider. 😄

Let me know if this makes sense.

jolexa commented 5 years ago

My two cents, the implementation of Oauth should not be Atlantis' concern. We already use Google Oauth in front of Atlantis UI via a sidecar-like process and I encourage that approach for everyone because there are several oauth providers, as you mentioned.

chenrui333 commented 5 years ago

That sounds about right. Is there any reference that you can share for the setup?

chenrui333 commented 5 years ago

I was recently looking at nginx-ingress plus oauth2-proxy, but could not get it working well.

jolexa commented 5 years ago

That sounds about right. Is there any reference that you can share for the setup?

Sorry, we don't have anything to share because our implementation is very organization specific. There are a few approaches, we have success using this right now https://github.com/cloudflare/nginx-google-oauth

chenrui333 commented 5 years ago

Cool, thanks for sharing. I will re-think if we can try the sidecar container route.

chenrui333 commented 5 years ago

When you do the deployment, how are you managing the session (Google OAuth) cookie between the Atlantis containers or just one Atlantis container deployment in your system?

Jaff commented 5 years ago

@jolexa @chenrui333 Were these issues resolved? We are in the same situation, needing to determine who is the user presenting the comments in order to channel workflow for proper permissions.

michyliao commented 4 years ago

@chenrui333 Were you able to set up atlantis using google oauth? I am trying to set up IAP with atlantis but am running into issues with github's webhook.

ted-fastly commented 4 years ago

For human traffic, we use zerotrust. Atlantis is only privately exposed except through Duo.