server: refactor: introduce AuthUser interface

[paul-marechal]

Replace the references to OAuth2User by AuthUser. This allows downstream extenders to more easily contribute alternative OAuth2 providers: If the expected data is stored in different attributes it will be possible to bridge it by implementing the proper AuthUser.

[paul-marechal]

Note that there seems to be an issue with formatting in this project...

I'm using VS Code along its Java extension to develop and it often feels like reorganizing or cleaning up imports.

I'd be in favor of keeping the cleanup as part of these changes.

It would be good to look into making auto-formatting part of the build step, maybe as a gradle plugin of some kind?

[paul-marechal]

Rebased my branch.

[paul-marechal]

@HeikoBoettger this class should make it easier to customize AuthUser instances. Right now it is hardcoded but you can later make this factory depend on some Spring configuration to customize attribute access.

[HeikoBoettger]

@paul-marechal I am not so familiar with spring, do you know how to map the "login" in the spring configuration? I only know about the "spring.security.oauth2.client.provider.my-oauth-provider.user-name-attribute=name". May be short hint somewhere in the openvsx documentation on how to customize the attribute access would be good.

Great work by the way.

[amvanbaren]

@HeikoBoettger Can you share which additional identity provider you were able to implement using this PR?

[HeikoBoettger-KarlStorz]

@HeikoBoettger Can you share which additional identity provider you were able to implement using this PR?

@amvanbaren Somehow I lost my comment. The PR didn't help completely, what is missing is basically a mapping of the login-attribute. One could add a GitLab specific mapping to the code, what I did based on this merge request adding a completely new generic provider type which uses additional setting from the application.yaml file defining for the web-interface what provider to use for the login-link and how to map the login (supporting mapping any of the attributes in the AuthUserFactory).

If the code could be changed to use spring.security.oauth2.client.provider.[providerId].user-name-attribute / providerDetails.userInfoEndpoint.userNameAttributeName as described in https://docs.spring.io/spring-security/reference/servlet/oauth2/login/core.html#oauth2login-sample-application-config. Instead of login I could abuse the GitHub provider entry.

To fully support other providers the UI would require a change to select the login method and the AuthToken inside the UserData class need to be contain a map from provider to token:

openvsx/server/src/main/java/org/eclipse/openvsx/entities/UserData.java

Line 63 in 072bf3e

private AuthToken githubToken;

Or the code gets simplified to just store an AuthToken for one provider at a time. I don't know why there are two fields in the UserData when there is only one provider-String.

[HeikoBoettger-KarlStorz]

@paul-marechal Is it possible to rebase this branch on to the latest master?

[amvanbaren]

Or the code gets simplified to just store an AuthToken for one provider at a time. I don't know why there are two fields in the UserData when there is only one provider-String.

The githubToken is to login. The eclipseToken is to check the publisher agreement.
We could rename githubToken to loginToken.

[paul-marechal]

Ok so I initially didn't want to bother implementing the configuration of attributes because it adds a decent amount of complexity... I changed my mind figuring it might make someone else's life easier.

The configuration may look like this:

ovsx:
  auth:
    attribute-names:
      gitlab:
        avatar-url: awdawd
        email: awdawd
        full-name: awdawd
        login-name: awdawd
        provider-url: awdawd

We don't need to define mappings for github as it's handled by default.

[amvanbaren]

@paul-marechal Thanks for providing the configuration. I'll try to configure Google OAuth using this PR.

[paul-marechal]

I want to apologize for forgetting to transpose code to handle OidcUserRequest we had to use for our fork... Without it we couldn't access certain attributes.

Second, there's still a need to manually edit the webui code to change the OAuth2 authorization endpoint used from github to whatever you want to reach. I'm not sure if we can somehow get rid of it or make it configurable yet. I will try so it's also less of a hassle...

This PR is slowly growing bigger than what we required on our fork so I hope this will help.

[amvanbaren]

there's still a need to manually edit the webui code

Yes, the login url is hardcoded in the webui:

openvsx/webui/src/extension-registry-service.ts

Lines 27 to 29 in 0f5315d

	getLoginUrl(): string {
	return createAbsoluteURL([this.serverUrl, 'oauth2', 'authorization', 'github']);
	}

The UserAPI has a login endpoint, but it causes CORS errors:

openvsx/server/src/main/java/org/eclipse/openvsx/UserAPI.java

Lines 72 to 77 in 0f5315d

	@GetMapping(
	path = "/login"
	)
	public ModelAndView login(ModelMap model) {
	return new ModelAndView("redirect:/oauth2/authorization/github", model);
	}

[paul-marechal]

I implemented the dynamic redirection based on a server configuration, I didn't encounter a CORS error?

ovsx:
  auth:
    provider: azure

openvsx/server/src/main/java/org/eclipse/openvsx/UserAPI.java

Lines 75 to 80 in 1abe659

	@GetMapping(
	path = "/login"
	)
	public ModelAndView login(ModelMap model) {
	return new ModelAndView("redirect:/oauth2/authorization/" + config.getAuth().getProvider(), model);
	}

[paul-marechal]

Using the latest commit I can now assert that no more code changes are required to configure a custom provider (following our use cases) as I was able to completely configure authentication to Azure using only the server spring config. I initially forgot to include a few modifications...

[HeikoBoettger-KarlStorz]

@paul-marechal Just to give an early feedback. I compared your changes with the modifications I did on my local branch I was thinking of contributing and it's more or less the same.

One thing I wonder is, do you use the githubToken to store the token in the database (UserData)? The TokenService also contains a switch block with the providers.

[paul-marechal]

I didn't find it required to store anything in githubToken.