Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support forwarding OAuth2 authorization header #267

Conversation

kalil-pelissier
Copy link
Contributor

Linked to trinodb/trino-go-client#130:

  • Forward authorization header through query args to trino-go-client SQL driver to handle it.
  • Update trino-go-client configuration to handle authorization header:
	config := trino.Config{
		ServerURI:        settings.URL.String(),
		Source:           "grafana",
		CustomClientName: "grafana",
          ++    ForwardAuthorizationHeader: "true",
	}

close #32

Copy link

cla-bot bot commented Oct 21, 2024

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

@kalil-pelissier kalil-pelissier marked this pull request as draft October 21, 2024 10:10
Copy link

cla-bot bot commented Oct 22, 2024

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

@kalil-pelissier kalil-pelissier force-pushed the feature/issue-213/forward-authorization-header branch from 6048aa2 to fe1c2e4 Compare October 30, 2024 13:02
Copy link

cla-bot bot commented Oct 30, 2024

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: kvlil.
This is most likely caused by a git client misconfiguration; please make sure to:

  1. check if your git client is configured with an email to sign commits git config --list | grep email
  2. If not, set it up using git config --global user.email email@example.com
  3. Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails

@kalil-pelissier kalil-pelissier force-pushed the feature/issue-213/forward-authorization-header branch from fe1c2e4 to ee27105 Compare October 30, 2024 13:27
@cla-bot cla-bot bot added the cla-signed label Oct 30, 2024
@kalil-pelissier kalil-pelissier force-pushed the feature/issue-213/forward-authorization-header branch from ee27105 to f36c54d Compare October 30, 2024 14:24
@kalil-pelissier kalil-pelissier marked this pull request as ready for review October 30, 2024 14:32
Copy link

cla-bot bot commented Oct 30, 2024

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: kvlil.
This is most likely caused by a git client misconfiguration; please make sure to:

  1. check if your git client is configured with an email to sign commits git config --list | grep email
  2. If not, set it up using git config --global user.email email@example.com
  3. Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails

@cla-bot cla-bot bot removed the cla-signed label Oct 30, 2024
@kalil-pelissier kalil-pelissier force-pushed the feature/issue-213/forward-authorization-header branch from cf5877d to e0a90f6 Compare October 30, 2024 15:41
@cla-bot cla-bot bot added the cla-signed label Oct 30, 2024
@kalil-pelissier kalil-pelissier force-pushed the feature/issue-213/forward-authorization-header branch 2 times, most recently from e0b0f2d to 07d32b1 Compare October 30, 2024 16:10
Copy link
Member

@nineinchnick nineinchnick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How did you test this?

pkg/trino/constants/keys.go Outdated Show resolved Hide resolved
pkg/trino/datasource-context.go Outdated Show resolved Hide resolved
@nineinchnick nineinchnick changed the title feature: support forward OAuth2 authorization header Support forwarding OAuth2 authorization header Oct 31, 2024
@nineinchnick
Copy link
Member

You can squash all commits and use the PR title as the commit message (describes the why, not what).

@kalil-pelissier kalil-pelissier force-pushed the feature/issue-213/forward-authorization-header branch from 07d32b1 to a69bf1a Compare October 31, 2024 09:45
pkg/trino/datasource.go Outdated Show resolved Hide resolved
pkg/trino/datasource-context.go Outdated Show resolved Hide resolved
@kalil-pelissier kalil-pelissier force-pushed the feature/issue-213/forward-authorization-header branch from a69bf1a to 438f36e Compare October 31, 2024 10:07
@kalil-pelissier
Copy link
Contributor Author

kalil-pelissier commented Oct 31, 2024

How did you test this?

For testing, I ran a local Grafan/Keycloak/Trino stack with docker-compose to check that the authorization header is forwarded between Grafana and Trino.

@nineinchnick nineinchnick merged commit 9432648 into trinodb:main Oct 31, 2024
2 checks passed
@kalil-pelissier
Copy link
Contributor Author

Hi @nineinchnick, thanks for approving and merging this PR!
Do you have an estimate on when these changes might be released?

@nineinchnick nineinchnick added the enhancement New feature or request label Nov 1, 2024
@nineinchnick
Copy link
Member

I just ran the release and submitted v1.0.8 for veification to Grafana.

@kalil-pelissier
Copy link
Contributor Author

Hi @nineinchnick,
I have noticed that the last release of the plugin hasn't been published on the official grafana repo. How long does it take for it to be published?

@nineinchnick
Copy link
Member

nineinchnick commented Nov 12, 2024

I've got a review comments from Grafana after I submitted the update, and I haven't had time to address them yet. I wish this was done publicly, like a PR review, but that's the current process. Here's the full message I got:

We recommend the following changes:

  • Instead of wrapping the instance factory function, instead update your existing function to receive context.Context and propagate this through the code paths instead of using context.Background(). This will ensure you code is more forward compatible with any changes to the SDK that rely on context propagation.
  • Please update the README to mention added OAuth forwarding functionality alongside existing auth methods as this will be helpful for users to understand how to make the most out of the plugin.

Some questions:

  • Considering this update will now pass the access token raw as a SQL query param, can you confirm that this information is not being logged anywhere? I did confirm that the call to log the dsn will only log forwardAuthorizationHeader=true, but just wanted to confirm with you as well.
  • I wanted to check if you found it necessary to pass the OAuth token via context as it should already be available via the headers http.Header argument in the SetQueryArgs function? I mainly just want to confirm you haven't found a bug.

This was anonymous, signed off as "Grafana Team"

@kalil-pelissier
Copy link
Contributor Author

Ok, thanks for the update,
How can it be addressed is it an internal process or can we open a PR to fix those reviews?

@nineinchnick
Copy link
Member

A PR would be very welcome!

@kalil-pelissier
Copy link
Contributor Author

Ok, I will open a PR with the Grafana Team review description and take care of it when I have time this week.
I'm not sure I get all the points and will probably need some clarification (the first review link looks outdated).

@nineinchnick
Copy link
Member

Thank you very much! There was only one PR merged after I cut 1.0.8. #274 removed logging of the DSN

@nineinchnick
Copy link
Member

I just submitted 1.0.9 for review and responded to all the questions I got for 1.0.8.

@kalil-pelissier
Copy link
Contributor Author

Thank you I didn't have time to work on it last week!

@kalil-pelissier
Copy link
Contributor Author

Hi @nineinchnick,
Is there any update for the publication of v1.0.9?

@nineinchnick
Copy link
Member

No, I need to test and merge #277 before I can submit another update for review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cla-signed enhancement New feature or request
Development

Successfully merging this pull request may close these issues.

Implement OAuth 2
2 participants