feat(monsoon-openstack-auth): add browser-side mTLS SSO login via JS#2055
Draft
bbobrov wants to merge 3 commits into
Draft
feat(monsoon-openstack-auth): add browser-side mTLS SSO login via JS#2055bbobrov wants to merge 3 commits into
bbobrov wants to merge 3 commits into
Conversation
…fetch to Keystone Implement a new authentication flow where the browser directly authenticates with Keystone using the cc_x509 external plugin via mTLS (client certificate presented through the upstream ingress), then posts the resulting token to Elektra's consume-auth-token endpoint to establish a Rails session. Changes: - Add sso_login.ts module that auto-fires on the login page, performing a cross-origin fetch to Keystone with X-User-Domain-Name header and methods=['external'], then posting the X-Subject-Token back to Elektra same-origin with CSRF protection - Add esbuild entry point (app/javascript/sso_login.ts) - Add meta tags to the login view for keystone-url, domain, and consume-path (only rendered when MONSOON_OPENSTACK_AUTH_API_ENDPOINT is configured) - Extend SessionsController#consume_auth_token to return JSON for raw=1 POST requests (the browser SSO path) while preserving existing redirect behaviour for legacy flows - Add comprehensive Vitest tests (12) and RSpec tests (8) covering the new path and backward compatibility The legacy server-side validate_sso_certificate path is preserved unchanged as a fallback.
…in Keystone fetch With Keystone returning Access-Control-Allow-Origin: * (the chart default when cors.allowed_origin is not set), the browser refuses to use the response when credentials mode is 'include'. Client certificate presentation is hostname-based at the TLS layer and is not affected by this option, so the mTLS flow keeps working. The same-origin fetch to /auth/sessions/consume_auth_token retains credentials:'same-origin' since it must carry the Rails session cookie.
…y-auth-token Replace the bespoke raw=1 path through SessionsController#consume_auth_token with a form POST to the existing /verify-auth-token endpoint, which already handles externally-obtained Keystone tokens for federated SSO (WebSSO, OIDC, SAML). Benefits: - No new server-side code in SessionsController; the rails-side flow is now identical to federation handover. - /verify-auth-token re-validates the token at Keystone and reads the user domain from the authoritative response. - ~180 lines of controller and spec code removed. Changes: - sso_login.ts: replace step-2 fetch+redirect with a hidden form submission to /verify-auth-token (token + authenticity_token). - sso_login.test.ts: rewrite step-2 tests to assert form construction and submission (9 tests, all passing). - sessions/new.html.erb: drop the sso-consume-path meta tag. - sessions_controller.rb: revert raw_sso_request?/consume_auth_token changes from the initial feat commit. - sessions_controller_spec.rb: revert the 8 SSO-specific tests from the initial feat commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implement a new authentication flow where the browser directly authenticates with Keystone using the cc_x509 external plugin via mTLS (client certificate presented through the upstream ingress), then posts the resulting token to Elektra's consume-auth-token endpoint to establish a Rails session.
Changes:
The legacy server-side validate_sso_certificate path is preserved unchanged as a fallback.
The template below is left empty on purpose, nothing from it was done.
Summary
Changes Made
Related Issues
Screenshots (if applicable)
Checklist