identity: add OIDC client credentials authentication - #3942
Conversation
github-actions
Bot
added
edit:openstack
9abdbf9 to
812d9c3
Compare
github-actions
Bot
added
semver:minor
|
coverage: 63.648% (+0.06%) from 63.588% — rm-you:feat/oidc-client-credentials into gophercloud:main |
812d9c3 to
1c66b75
Compare
1c66b75 to
7d9a69c
Compare
winiciusallan
left a comment
winiciusallan
left a comment
There was a problem hiding this comment.
Thanks @rm-you for proposing all these identity-related things. I'm doing my best to give useful insights while avoiding making wrong assumptions (I'm not familiar with keystone flow).
| func validateAuthOptions(opts *AuthOptions) error { | ||
| if opts.IdentityProviderName == "" { | ||
| return fmt.Errorf("missing required field: IdentityProviderName") | ||
| } | ||
| if opts.Protocol == "" { | ||
| return fmt.Errorf("missing required field: Protocol") | ||
| } | ||
| if opts.ClientID == "" { | ||
| return fmt.Errorf("missing required field: ClientID") | ||
| } | ||
| if opts.AccessTokenEndpoint == "" && opts.DiscoveryEndpoint == "" { | ||
| return fmt.Errorf("at least one of AccessTokenEndpoint or DiscoveryEndpoint must be provided") | ||
| } | ||
| return nil | ||
| } |
There was a problem hiding this comment.
I think you can use the required:"true" json tag in AuthOptions to use our existing validation. Then call gophercloud.BuildRequestBody(any, parent) in ToTokenV3CreateMap which you'd also need to call it at creation.
There was a problem hiding this comment.
Done in 3083622: validation now uses required/or tags via BuildRequestBody, called through ToTokenV3CreateMap during creation. Either endpoint (or both) is still accepted, explicit endpoint precedence is unchanged, and regression tests cover both entry points.
Good call, missed this. :)
Also adjusted a couple other PRs to match.
Refs gophercloud#3283 Co-authored-by: Taiwo Oyewole <taiwooyewole@geico.com>
7d9a69c to
3083622
Compare
3 participants
Fixes #3283
Adds Identity v3 authentication using the OpenID Connect client-credentials grant. It obtains an access token from an explicitly configured or discovered token endpoint, exchanges it for an unscoped Keystone token through the federation API, and optionally scopes the result with the existing token API.
The same flow supports reauthentication.
Links to the line numbers/files in the OpenStack source code that support the code in this PR: