<div><br><div class="gmail_quote"><div>On Fri, Jan 27, 2017 at 12:06 AM Shoubhik Bose <<a href="mailto:shbose@redhat.com">shbose@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg">On Fri, Jan 27, 2017 at 1:06 PM, Alexey Kazakov <span class="gmail_msg"><<a href="mailto:alkazako@redhat.com" class="gmail_msg" target="_blank">alkazako@redhat.com</a>></span> wrote:<br class="gmail_msg"><blockquote class="gmail_quote gmail_msg" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF" class="gmail_msg">
Hi all,<br class="gmail_msg">
<br class="gmail_msg">
After some discussion with Aslak and Max I would lit to share
proposal of User/login model update in almighty-core as part of our
move to Keycloak auth. I'm copying this from
<a class="m_9040124467340007774gmail-m_7461226904653269219moz-txt-link-freetext gmail_msg" href="https://github.com/almighty/almighty-core/issues/672" target="_blank">https://github.com/almighty/almighty-core/issues/672</a> (Use keycloak
tokens instead of generating our own ones when serving client auth
requests).
<br class="gmail_msg">
<br class="gmail_msg">
<i class="gmail_msg"><b class="gmail_msg">What we currently have in our model:</b></i><br class="gmail_msg">
<br class="gmail_msg">
<b class="gmail_msg">Identity</b> (represents a user)<br class="gmail_msg">
<br class="gmail_msg">
- uuid (generated automatically) - This uuid is used as
"creator" and "assignee" in our payloads and it's also stored in the
JWT token we generate after authentication.<br class="gmail_msg">
- fullName (human name - string)<br class="gmail_msg">
- avatarImage (URL string)<br class="gmail_msg">
- users []User (list of associated users, each user just
represents a email)<br class="gmail_msg">
<br class="gmail_msg">
<b class="gmail_msg">User</b><br class="gmail_msg">
<br class="gmail_msg">
- uuid (generated automatically)<br class="gmail_msg">
- email (just a string)<br class="gmail_msg">
- identity-uuid (Identity association)<br class="gmail_msg">
<br class="gmail_msg">
<b class="gmail_msg"><i class="gmail_msg">Proposed model:</i></b><br class="gmail_msg">
<br class="gmail_msg">
<b class="gmail_msg">User</b> (represents a user account in our system)<br class="gmail_msg">
<br class="gmail_msg">
- uuid (generated automatically) - Our internal user ID. Used
for associations with Logins<br class="gmail_msg">
- fullName (human name - string)<br class="gmail_msg">
- avatarImage (URL string)<br class="gmail_msg">
- logins []Login (list of associated logins)<br class="gmail_msg">
<br class="gmail_msg">
<b class="gmail_msg">Login</b> I actually don't like this name. Can we call it <b class="gmail_msg">Identity
Provider User</b> or somewhat else to avoid confusions? This is a
representation of user provided by some particular Identity Provider
such as: a) Our Keycloak; b) GitHub (for remote WI's); c) JIRA (for
remote WI's), etc.<br class="gmail_msg">
<br class="gmail_msg">
- uuid - Generated automatically for remote WI but in case of KC
the uuid from the KC user is used. This uuid is used as "creator"
and "assignee" in our payloads and it's also represented in the KC
token we retrieve from KC during authentication. So, our token is
always associated with a Login.<br class="gmail_msg">
- username (string) - Username used by corresponding IDP. It's
not unique in our system (it's supposed to be unique for the
particular IDP though).<br class="gmail_msg">
- email (string)<br class="gmail_msg">
- idp (string) - Some IDP key/ID which will indicate from what
IDP we got this Login. Possible values: "keycloak", "github",
"jira", etc.<br class="gmail_msg">
<br class="gmail_msg"></div></blockquote><div class="gmail_msg"><br class="gmail_msg"></div></div></div></div><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div class="gmail_msg">I see a deviation from the previous model where we stored <b class="gmail_msg">identity-uuid </b>in the (old)<b class="gmail_msg">User</b> model.I guess the deviation is because for remote workitems , we only have the "Login" and not the (new model) User. </div></div></div></div></blockquote><div><br></div><div>Oops, I forgot to add a user-uuid field to Login. We will need this field for User-Login associations. But this field is optional. Keycloak logins are always associated with a User. Remote WIs may not.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div class="gmail_msg"><br class="gmail_msg"></div></div></div></div><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div class="gmail_msg"><br class="gmail_msg"> </div><blockquote class="gmail_quote gmail_msg" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="#FFFFFF" class="gmail_msg">
When a user is logging in we authenticate in our Keycloak (which
uses <a href="http://developers.redhat.com" class="gmail_msg" target="_blank">developers.redhat.com</a> as the default IDP). A new Login is
created. We use uuid of the Keycloak user. idp="keycloak". We also
create a User and associate these User - Login. We return the
retrieved Keycloak token which will be used by UI for
authentication. So there is a strong assassination between a token
and a keyclaok Login.<br class="gmail_msg">
<br class="gmail_msg"></div></blockquote><div class="gmail_msg"><br class="gmail_msg"></div></div></div></div><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div class="gmail_msg">This sounds good.<br class="gmail_msg"></div></div></div></div><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div class="gmail_msg"> </div><blockquote class="gmail_quote gmail_msg" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="#FFFFFF" class="gmail_msg">
When we import a remote WI (from JIRA, github, etc) we create a
Login which is not associated with any User yet. Open question: how
we associate remote WI's (imported from github, etc) with User. We
would need some manual workflow for that.<br class="gmail_msg"></div></blockquote><div class="gmail_msg"><br class="gmail_msg"><br class="gmail_msg"></div></div></div></div><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div class="gmail_msg">When we import remote workitems from github, are we going to leave the 'email' field blank/null in <b class="gmail_msg">Login</b> ?<br class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">One complex way to get user email information in case of github is that the API response for a GH issue <br class="gmail_msg"><br class="gmail_msg">- <a href="https://api.github.com/repos/almighty/almighty-core/issues/133" class="gmail_msg" target="_blank">https://api.github.com/repos/almighty/almighty-core/issues/133</a><br class="gmail_msg"></div><div class="gmail_msg">has the user endpoints.<br class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">- the creator/assignee api url is found in the response as <a href="https://api.github.com/users/aslakknutsen" class="gmail_msg" target="_blank">https://api.github.com/users/aslakknutsen</a> which further provides the email address,full name,etc<br class="gmail_msg"></div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">- use this email address to associate a <b class="gmail_msg">Login </b>with a <b class="gmail_msg">User . </b>Drawback of this is that github allows addition of multiple email addresses which the GH API wouldn't expose.<br class="gmail_msg"><br class="gmail_msg"><br class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"><b class="gmail_msg">Another way </b>is to use the github user url to uniquely identify a <b class="gmail_msg">Login</b><br class="gmail_msg"></div><div bgcolor="#FFFFFF" class="gmail_msg"> So the combo of an [ idp "github" + gh user url ] is always going to be unique in the <b class="gmail_msg">Login </b>table. This could lead to using user urls instead of email for all IDPs ?</div></div></div></div><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div bgcolor="#FFFFFF" class="gmail_msg"><br class="gmail_msg"><br class="gmail_msg"><br class="gmail_msg">
This update will requre a massive refactoring in almighty-core (and
ui probably too) :-(<br class="gmail_msg">
<br class="gmail_msg">
Any thoughts?<br class="gmail_msg">
</div></div></div></div><div class="gmail_msg"><div class="gmail_extra gmail_msg"><div class="gmail_quote gmail_msg"><div bgcolor="#FFFFFF" class="gmail_msg"></div><blockquote class="gmail_quote gmail_msg" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br class="gmail_msg">_______________________________________________<br class="gmail_msg">
almighty-public mailing list<br class="gmail_msg">
<a href="mailto:almighty-public@redhat.com" class="gmail_msg" target="_blank">almighty-public@redhat.com</a><br class="gmail_msg">
<a href="https://www.redhat.com/mailman/listinfo/almighty-public" rel="noreferrer" class="gmail_msg" target="_blank">https://www.redhat.com/mailman/listinfo/almighty-public</a><br class="gmail_msg">
<br class="gmail_msg"></blockquote></div><br class="gmail_msg"></div></div>
</blockquote></div></div>