Re: Add modern authentication (OAuth 2.0 + OIDC) to TortoiseSVN
TortoiseSVN-dev <[email protected]> Wed, 27 Mar 2024 14:42:38 +0100
| Newsgroups | gmane.comp.version-control.subversion.tortoisesvn.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_DC37024C-20A5-41B9-8BA5-9697D5F62D10 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Hi Jon and Daniel, Sorry about the late response.=20 We are running TSVN with OpenIDC authenticating with Entra ID (Azure AD), n= ot through the Microsoft Azure Application Proxy though. Server-side, we have Apache httpd as usual but we add the open-source mod_o= penidc module (instead of basic auth). In addition, some rewrites and other= config that allows us to tunnel the session token in basic auth (which TSV= N supports).=20 We currently have an installed application that performs the OpenIDC authen= tication and then inserts the session token in the svn auth cache as a basi= c authentication. In order to achieve a cleaner implementation that can als= o work with Microsoft Azure Application Proxy the session token must be sen= t as a cookie. We would be interested in contributing experience, specifications and serve= r setups if we can get the following stars aligned: - Financial / developer contributions=20 - Subversion core committer interest=20 - TSVN committer interest =20 We also need to reach consensus in primarily the Subversion project but the= re is relatively limited amounts of changes that must happen there.=20 - Sending cookie header with session token instead of basic auth.=20 - Capture set-cookie response headers related to refresh of the session co= okie. - "svn auth" support for storing session token, very similar to basic auth= (cookie name and the token).=20 - maybe something related to handling redirect to ensure that TSVN can act= on that When that is in place, I believe it would be possible to have a standalone = helper application that performs the authentication and stores it using the= "svn auth" subcommand (or equivalent). Alternatively add this support in T= SVN which would be the ideal UX. Best regards, Thomas =C3=85. > On 20 Mar 2024, at 08:28, Daniel Sahlberg via TortoiseSVN-dev <tortoisesv= [email protected]> wrote: >=20 > From what I understand, OAuth2 requires both server- and clientside suppo= rt. So any solution would need to involve both TortoiseSVN and the Subversi= on project (or VisualSVN). I think it is a great idea but I think some addi= tional development resources would be required to make this happen. Any cha= nce that you (or your company) can get involved in making this happen? >=20 > Kind regards, > Daniel >=20 > onsdag 20 mars 2024 kl. 08:11:28 UTC+1 skrev [email protected] <ht= tp://parabilis-space.com/>: > We have run into a problem trying to implement SVN on our secure cloud pl= atform. Is it possible to pay someone to add modern authentication to Tort= oiseSVN? >=20 > Specifically we wish to use TortoiseSVN client to access VisualSVN Serve= r via Microsoft Azure Application Proxy. This requires TSVN to be conversa= nt in "OAuth 2.0 with OpenID Connect (OIDC)". See https://auth0.com/docs/a= uthenticate/protocols/openid-connect-protocol <https://auth0.com/docs/authe= nticate/protocols/openid-connect-protocol> > You can see the error we get by using TortoiseSVN to open this test repos= itory https://visualsvn.parabilis-space.com/svn/test/ <https://visualsvn.pa= rabilis-space.com/svn/test/>=20 > Error: Repository moved temporarily to ...Oath2/authorize... >=20 >=20 > Thank You, >=20 > --Jon >=20 >=20 > --=20 > You received this message because you are subscribed to the Google Groups= "TortoiseSVN-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an= email to [email protected] <mailto:tortoisesvn-= [email protected]>. > To view this discussion on the web visit https://groups.google.com/d/msgi= d/tortoisesvn-dev/4dc5d482-62d0-4c7d-b375-9e1b5e467baan%40googlegroups.com = <https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-62d0-4c7d-b375-= 9e1b5e467baan%40googlegroups.com?utm_medium=3Demail&utm_source=3Dfooter>. --=20 You received this message because you are subscribed to the Google Groups "= TortoiseSVN-dev" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/= tortoisesvn-dev/382E9C80-79E8-4548-A667-D664D8EA95D9%40fastmail.se. --Apple-Mail=_DC37024C-20A5-41B9-8BA5-9697D5F62D10 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="UTF-8" <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset= =3Dutf-8"></head><body style=3D"word-wrap: break-word; -webkit-nbsp-mode: s= pace; line-break: after-white-space;" class=3D""><div style=3D"margin: 0px;= font-stretch: normal; font-size: 13px; line-height: normal; font-family: &= quot;Helvetica Neue";" class=3D"">Hi Jon and Daniel,</div><div style= =3D"margin: 0px; font-stretch: normal; font-size: 13px; line-height: normal= ; font-family: "Helvetica Neue"; min-height: 15px;" class=3D""><b= r class=3D""></div><div style=3D"margin: 0px; font-stretch: normal; font-si= ze: 13px; line-height: normal; font-family: "Helvetica Neue";" cl= ass=3D"">Sorry about the late response. </div><div style=3D"margin: 0p= x; font-stretch: normal; font-size: 13px; line-height: normal; font-family:= "Helvetica Neue"; min-height: 15px;" class=3D""><br class=3D""><= /div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13px; line= -height: normal; font-family: "Helvetica Neue";" class=3D"">We ar= e running TSVN with OpenIDC authenticating with Entra ID (Azure AD), not th= rough the Microsoft Azure Application Proxy though.</div><div style=3D"marg= in: 0px; font-stretch: normal; font-size: 13px; line-height: normal; font-f= amily: "Helvetica Neue"; min-height: 15px;" class=3D""><br class= =3D""></div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13p= x; line-height: normal; font-family: "Helvetica Neue";" class=3D"= ">Server-side, we have Apache httpd as usual but we add the open-source mod= _openidc module (instead of basic auth). In addition, some rewrites and oth= er config that allows us to tunnel the session token in basic auth (which T= SVN supports). </div><div style=3D"margin: 0px; font-stretch: normal; = font-size: 13px; line-height: normal; font-family: "Helvetica Neue&quo= t;; min-height: 15px;" class=3D""><br class=3D""></div><div style=3D"margin= : 0px; font-stretch: normal; font-size: 13px; line-height: normal; font-fam= ily: "Helvetica Neue";" class=3D"">We currently have an installed= application that performs the OpenIDC authentication and then inserts the = session token in the svn auth cache as a basic authentication. In orde= r to achieve a cleaner implementation that can also work with Microsoft Azu= re Application Proxy the session token must be sent as a cookie.</div><div = style=3D"margin: 0px; font-stretch: normal; font-size: 13px; line-height: n= ormal; font-family: "Helvetica Neue"; min-height: 15px;" class=3D= ""><br class=3D""></div><div style=3D"margin: 0px; font-stretch: normal; fo= nt-size: 13px; line-height: normal; font-family: "Helvetica Neue"= ;" class=3D"">We would be interested in contributing experience, specificat= ions and server setups if we can get the following stars aligned:</div><div= style=3D"margin: 0px; font-stretch: normal; font-size: 13px; line-height: = normal; font-family: "Helvetica Neue";" class=3D""> - Financ= ial / developer contributions </div><div style=3D"margin: 0px; font-st= retch: normal; font-size: 13px; line-height: normal; font-family: "Hel= vetica Neue";" class=3D""> - Subversion core committer interest&n= bsp;</div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13px;= line-height: normal; font-family: "Helvetica Neue";" class=3D"">= - TSVN committer interest</div><p style=3D"margin: 0px; font-stretch:= normal; font-size: 13px; line-height: normal; font-family: "Helvetica= Neue"; min-height: 15px;" class=3D""> <br class=3D"webkit-block-= placeholder"></p><div style=3D"margin: 0px; font-stretch: normal; font-size= : 13px; line-height: normal; font-family: "Helvetica Neue";" clas= s=3D"">We also need to reach consensus in primarily the Subversion project = but there is relatively limited amounts of changes that must happen there.&= nbsp;</div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13px= ; line-height: normal; font-family: "Helvetica Neue";" class=3D""= > - Sending cookie header with session token instead of basic auth.&nb= sp;</div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13px; = line-height: normal; font-family: "Helvetica Neue";" class=3D"">&= nbsp;- Capture set-cookie response headers related to refresh of the sessio= n cookie.</div><div style=3D"margin: 0px; font-stretch: normal; font-size: = 13px; line-height: normal; font-family: "Helvetica Neue";" class= =3D""> - "svn auth" support for storing session token, very similar to= basic auth (cookie name and the token). </div><div style=3D"margin: 0= px; font-stretch: normal; font-size: 13px; line-height: normal; font-family= : "Helvetica Neue";" class=3D""> - maybe something related t= o handling redirect to ensure that TSVN can act on that</div><div style=3D"= margin: 0px; font-stretch: normal; font-size: 13px; line-height: normal; fo= nt-family: "Helvetica Neue"; min-height: 15px;" class=3D""><br cl= ass=3D""></div><div style=3D"margin: 0px; font-stretch: normal; font-size: = 13px; line-height: normal; font-family: "Helvetica Neue";" class= =3D"">When that is in place, I believe it would be possible to have a stand= alone helper application that performs the authentication and stores it usi= ng the "svn auth" subcommand (or equivalent). Alternatively add this suppor= t in TSVN which would be the ideal UX.</div><div style=3D"margin: 0px; font= -stretch: normal; font-size: 13px; line-height: normal; font-family: "= Helvetica Neue"; min-height: 15px;" class=3D""><br class=3D""></div><d= iv style=3D"margin: 0px; font-stretch: normal; font-size: 13px; line-height= : normal; font-family: "Helvetica Neue";" class=3D"">Best regards= ,</div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13px; li= ne-height: normal; font-family: "Helvetica Neue";" class=3D"">Tho= mas =C3=85.</div><div style=3D"margin: 0px; font-stretch: normal; font-size= : 13px; line-height: normal; font-family: "Helvetica Neue";" clas= s=3D""><br class=3D""></div><div><br class=3D""><blockquote type=3D"cite" c= lass=3D""><div class=3D"">On 20 Mar 2024, at 08:28, Daniel Sahlberg via Tor= toiseSVN-dev <<a href=3D"mailto:[email protected]" class= =3D"">[email protected]</a>> wrote:</div><br class=3D"App= le-interchange-newline"><div class=3D""><meta charset=3D"UTF-8" class=3D"">= <span style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size= : 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; le= tter-spacing: normal; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0p= x; text-decoration: none; float: none; display: inline !important;" class= =3D"">From what I understand, OAuth2 requires both server- and clientside s= upport. So any solution would need to involve both TortoiseSVN and the Subv= ersion project (or VisualSVN). I think it is a great idea but I think some = additional development resources would be required to make this happen. Any= chance that you (or your company) can get involved in making this happen?<= /span><div style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font= -size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 40= 0; letter-spacing: normal; text-align: start; text-indent: 0px; text-transf= orm: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-widt= h: 0px; text-decoration: none;" class=3D""><br class=3D""></div><div style= =3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; fon= t-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacin= g: normal; text-align: start; text-indent: 0px; text-transform: none; white= -space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-dec= oration: none;" class=3D"">Kind regards,</div><div style=3D"caret-color: rg= b(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; fo= nt-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-ali= gn: start; text-indent: 0px; text-transform: none; white-space: normal; wor= d-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" cla= ss=3D"">Daniel<br class=3D""><br class=3D""><div class=3D""><div dir=3D"aut= o" class=3D"">onsdag 20 mars 2024 kl. 08:11:28 UTC+1 skrev j...@<a href=3D"= http://parabilis-space.com/" class=3D"">parabilis-space.com</a>:<br class= =3D""></div><blockquote style=3D"margin: 0px 0px 0px 0.8ex; border-left-wid= th: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); p= adding-left: 1ex;" class=3D""><p class=3D"">We have run into a problem tryi= ng to implement SVN on our secure cloud platform. Is it possible to p= ay someone to add modern authentication to TortoiseSVN?</p><p class=3D"">&n= bsp;Specifically we wish to use TortoiseSVN client to access VisualSVN Serv= er via Microsoft Azure Application Proxy. This requires TSVN to be co= nversant in "OAuth 2.0 with OpenID Connect (OIDC)". See <a href= =3D"https://auth0.com/docs/authenticate/protocols/openid-connect-protocol" = target=3D"_blank" rel=3D"nofollow" class=3D"">https://auth0.com/docs/authen= ticate/protocols/openid-connect-protocol</a></p><p class=3D"">You can see t= he error we get by using TortoiseSVN to open this test repository<span clas= s=3D"Apple-converted-space"> </span><a href=3D"https://visualsvn.parab= ilis-space.com/svn/test/" target=3D"_blank" rel=3D"nofollow" class=3D"">htt= ps://visualsvn.parabilis-space.com/svn/test/</a> <br class=3D""><span = style=3D"font-family: Calibri, sans-serif; font-size: 11pt;" class=3D"">Err= or: Repository moved temporarily to ...Oath2/authorize...</span></p><div cl= ass=3D""><br class=3D"webkit-block-placeholder"></div><p class=3D"">Thank Y= ou,<br class=3D""></p><p class=3D"">--Jon<br class=3D""></p></blockquote></= div></div><div style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight= : 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-tr= ansform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-= width: 0px; text-decoration: none;" class=3D""><br class=3D"webkit-block-pl= aceholder"></div><span style=3D"caret-color: rgb(0, 0, 0); font-family: Hel= vetica; font-size: 12px; font-style: normal; font-variant-caps: normal; fon= t-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px;= text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text= -stroke-width: 0px; text-decoration: none; float: none; display: inline !im= portant;" class=3D"">--<span class=3D"Apple-converted-space"> </span><= /span><br style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-= size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400= ; letter-spacing: normal; text-align: start; text-indent: 0px; text-transfo= rm: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width= : 0px; text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0= , 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-= variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align:= start; text-indent: 0px; text-transform: none; white-space: normal; word-s= pacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: = none; display: inline !important;" class=3D"">You received this message bec= ause you are subscribed to the Google Groups "TortoiseSVN-dev" group.</span= ><br style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size:= 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; let= ter-spacing: normal; text-align: start; text-indent: 0px; text-transform: n= one; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px= ; text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-varia= nt-caps: normal; font-weight: 400; letter-spacing: normal; text-align: star= t; text-indent: 0px; text-transform: none; white-space: normal; word-spacin= g: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none;= display: inline !important;" class=3D"">To unsubscribe from this group and= stop receiving emails from it, send an email to<span class=3D"Apple-conver= ted-space"> </span></span><a href=3D"mailto:tortoisesvn-dev+unsubscrib= [email protected]" style=3D"font-family: Helvetica; font-size: 12px; font-= style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing:= normal; orphans: auto; text-align: start; text-indent: 0px; text-transform= : none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-= size-adjust: auto; -webkit-text-stroke-width: 0px;" class=3D"">tortoisesvn-= [email protected]</a><span style=3D"caret-color: rgb(0, 0, 0= ); font-family: Helvetica; font-size: 12px; font-style: normal; font-varian= t-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start= ; text-indent: 0px; text-transform: none; white-space: normal; word-spacing= : 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">.</span><br style=3D"caret-color: r= gb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; f= ont-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-al= ign: start; text-indent: 0px; text-transform: none; white-space: normal; wo= rd-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" cl= ass=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight= : 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-tr= ansform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-= width: 0px; text-decoration: none; float: none; display: inline !important;= " class=3D"">To view this discussion on the web visit<span class=3D"Apple-c= onverted-space"> </span></span><a href=3D"https://groups.google.com/d/= msgid/tortoisesvn-dev/4dc5d482-62d0-4c7d-b375-9e1b5e467baan%40googlegroups.= com?utm_medium=3Demail&utm_source=3Dfooter" style=3D"font-family: Helve= tica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-= weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text= -indent: 0px; text-transform: none; white-space: normal; widows: auto; word= -spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0= px;" class=3D"">https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-= 62d0-4c7d-b375-9e1b5e467baan%40googlegroups.com</a><span style=3D"caret-col= or: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: norm= al; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; te= xt-align: start; text-indent: 0px; text-transform: none; white-space: norma= l; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none= ; float: none; display: inline !important;" class=3D"">.</span></div></bloc= kquote></div><br class=3D""></body></html> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;TortoiseSVN-dev" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">tor= [email protected]</a>.<br /> To view this discussion on the web visit <a href=3D"https://groups.google.c= om/d/msgid/tortoisesvn-dev/382E9C80-79E8-4548-A667-D664D8EA95D9%40fastmail.= se?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgi= d/tortoisesvn-dev/382E9C80-79E8-4548-A667-D664D8EA95D9%40fastmail.se</a>.<b= r /> --Apple-Mail=_DC37024C-20A5-41B9-8BA5-9697D5F62D10--