Hello I am working on setting up OAuth. We have Envoy webservice to authenticate the incoming and outgoing traffic. The username is passed to datahub via HTTP request header and cookies after a successful/cached login. For example, Header: x-forwarded-user=ben Cookie: OAuthUsername=ben Any suggestion on how to integrate with datahub web ui? Thanks

Hi! I thought Envoy was primarily used as a proxy, are you using an identity provider under the hood of the edge proxy for authentication? DataHub integrates at the identity provider level for verifying OAuth tokens: https://datahubproject.io/docs/how/auth/sso/configure-oidc-react

Hi @orange-night-91387 Thanks for your hint. The envoy is different from oidc auth. Envoy will authentic incoming traffic before it hit datahub. So datahub can assume all requests are authenticated. The user information is in the http header.

I don't think this setup is currently supported, you basically want DataHub to not validate the OAuth token against an identity provider and extract custom headers from Envoy to use as user information? cc: @big-carpet-38439

Yes.

Let me think about this... there should be some way..

Hi @big-carpet-38439 I replaced authenticators in application.yml

authenticators:
    - type: com.datahub.authentication.authenticator.PinterestAuthenticator

and created the PinterestAuthenticator

public class PinterestAuthenticator implements Authenticator {

  @Override
  public void init(@Nonnull final Map<String, Object> config) {
  }

  @Override
  public Authentication authenticate(@Nonnull AuthenticatorContext context) throws AuthenticationException {
    return new Authentication(new Actor(ActorType.USER, "zxu"), "123");
  }
}

Then I

./gradlew build
./docker/dev.sh

Using Incognito to visit localhost:9002 Then I am still required to login. Do you think it is expected? Thanks

Hmm. Okay let me think - this is the first case someone has requested this. I think now your API requests will be authenticated correctly but the UI handles things slightly differently than the backend…. Thinking…

Good morning @big-carpet-38439 Is there any update? Should I dive into code? If so, can you tell me what is the entry point in UI about auth? Thanks

I'm going to have @incalculable-ocean-74010 Help me out on this one. Essentially what we need is an easy way to plugin an authenticator at the UI level itself to log folks in when we see a particular trusted header. Is this header guaranteed to be provided for each and every request?

It is a cookie

Ah it's a cookie on

@incalculable-ocean-74010 Do you want me to do anything to unblock this? Thanks

Need to sync with John first. If I have any questions I’ll let you know but thank you!

So here's how our frontend works... We first have a login process (either JaaS or OIDC) which results in a yes or no decision. If yes, then we provision a "token" for the user which grants access to backend APIs. We set this token inside a session cookie(s) (PLAY_SESSION + actor) on our own. In subsequent requests, we simply extract the token from the first cookie and add it to requests to our backend. So in your case ideally I'd like to translate the incoming cookie into a proper session token + actor cookie as usual, and then simply trust those from that point on. In other words, the cookie from Envoy would simply serve as a way to perform the first step of "login", after which the existing flow works the same way. Does this sound like something that could work? (If we exposed an easy interface for validating the cookie when "authentication" happens?

Thanks @big-carpet-38439 and @incalculable-ocean-74010 Now the oauth works

@mysterious-lamp-91034 How did you get this working?

Just follow your words ^ - AUTH_JAAS_ENABLED=false Updating the AuthenticationController, in authenticate() we don't let it fall back to default user, we check the header/cookie, and create the CorpuserUrn

Thats amazing!