Re: Add modern authentication (OAuth 2.0 + OIDC) to TortoiseSVN
Daniel Sahlberg via TortoiseSVN-dev <[email protected]> Fri, 29 Mar 2024 05:41:21 -0700 (PDT)
| Newsgroups | gmane.comp.version-control.subversion.tortoisesvn.devel |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_40940_1242960193.1711716081320 Content-Type: multipart/alternative; boundary="----=_Part_40941_1548078580.1711716081320" ------=_Part_40941_1548078580.1711716081320 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, fredag 29 mars 2024 kl. 10:02:33 UTC+1 skrev Thomas =C3=85kesson: Hi Jon and Daniel, Sorry about the late response.=20 We are running TSVN with OpenIDC authenticating with Entra ID (Azure AD),= =20 not through the Microsoft Azure Application Proxy though. Server-side, we have Apache httpd as usual but we add the open-source=20 mod_openidc module (instead of basic auth). In addition, some rewrites and= =20 other config that allows us to tunnel the session token in basic auth=20 (which TSVN supports).=20 We currently have an installed application that performs the OpenIDC=20 authentication and then inserts the session token in the svn auth cache as= =20 a basic authentication. In order to achieve a cleaner implementation that= =20 can also work with Microsoft Azure Application Proxy the session token must= =20 be sent as a cookie. We would be interested in contributing experience, specifications and=20 server setups if we can get the following stars aligned: - Financial / developer contributions=20 - Subversion core committer interest=20 - TSVN committer interest Hi, This sounds really interesting. I'm committer in both Subversion and TSVN= =20 (and in Serf, if that would be necessary) and as long as things are=20 discussed in the appropriate -dev lists, I can sponsor the commits.=20 Unfortunately I'm not in a position to contribute very much code, simply=20 because of a lack of time. =20 We also need to reach consensus in primarily the Subversion project but=20 there is relatively limited amounts of changes that must happen there.=20 - Sending cookie header with session token instead of basic auth.=20 - Capture set-cookie response headers related to refresh of the session=20 cookie. - "svn auth" support for storing session token, very similar to basic auth= =20 (cookie name and the token).=20 These things doesn't sound all that complicated, but should probably be=20 discussed on [email protected]. Would you like to bring this=20 discussion over there? =20 - maybe something related to handling redirect to ensure that TSVN can act= =20 on that I presume we need to have a notification callback function in Subversion=20 that TSVN can catch to show the authentication webpage, much like any other= =20 OAuth2 compatible application does, is this correct? =20 When that is in place, I believe it would be possible to have a standalone= =20 helper application that performs the authentication and stores it using the= =20 "svn auth" subcommand (or equivalent). Alternatively add this support in=20 TSVN which would be the ideal UX. Best regards, Thomas =C3=85. On 20 Mar 2024, at 08:28, Daniel Sahlberg via TortoiseSVN-dev < [email protected]> wrote: From what I understand, OAuth2 requires both server- and clientside=20 support. So any solution would need to involve both TortoiseSVN and the=20 Subversion project (or VisualSVN). I think it is a great idea but I think= =20 some additional development resources would be required to make this=20 happen. Any chance that you (or your company) can get involved in making=20 this happen? Kind regards, Daniel onsdag 20 mars 2024 kl. 08:11:28 UTC+1 skrev [email protected]: We have run into a problem trying to implement SVN on our secure cloud=20 platform. Is it possible to pay someone to add modern authentication to=20 TortoiseSVN? Specifically we wish to use TortoiseSVN client to access VisualSVN Server= =20 via Microsoft Azure Application Proxy. This requires TSVN to be conversant= =20 in "OAuth 2.0 with OpenID Connect (OIDC)". See=20 https://auth0.com/docs/authenticate/protocols/openid-connect-protocol You can see the error we get by using TortoiseSVN to open this test=20 repository https://visualsvn.parabilis-space.com/svn/test/=20 Error: Repository moved temporarily to ...Oath2/authorize... Thank You, --Jon --=20 You received this message because you are subscribed to the Google Groups= =20 "TortoiseSVN-dev" group. To unsubscribe from this group and stop receiving emails from it, send an= =20 email to [email protected]. To view this discussion on the web visit=20 https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-62d0-4c7d-b375-9= e1b5e467baan%40googlegroups.com=20 <https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-62d0-4c7d-b375-= 9e1b5e467baan%40googlegroups.com?utm_medium=3Demail&utm_source=3Dfooter> . --=20 You received this message because you are subscribed to the Google Groups "= TortoiseSVN-dev" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/= tortoisesvn-dev/00eb0964-485a-4c49-a73d-522745766195n%40googlegroups.com. ------=_Part_40941_1548078580.1711716081320 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div><div dir=3D"auto">Hi,</div><div dir=3D"auto"><br /></div><div dir=3D"a= uto">fredag 29 mars 2024 kl. 10:02:33 UTC+1 skrev Thomas =C3=85kesson:<br /= ></div><blockquote style=3D"margin: 0px 0px 0px 0.8ex; border-left: 1px sol= id rgb(204, 204, 204); padding-left: 1ex;"><div style=3D"overflow-wrap: bre= ak-word;"><div style=3D"margin: 0px; font-stretch: normal; font-size: 13px;= line-height: normal; font-family: "Helvetica Neue";">Hi Jon and = Daniel,</div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13= px; line-height: normal; font-family: "Helvetica Neue"; min-heigh= t: 15px;"><br /></div><div style=3D"margin: 0px; font-stretch: normal; font= -size: 13px; line-height: normal; font-family: "Helvetica Neue";"= >Sorry about the late response.=C2=A0</div><div style=3D"margin: 0px; font-= stretch: normal; font-size: 13px; line-height: normal; font-family: "H= elvetica Neue"; min-height: 15px;"><br /></div><div style=3D"margin: 0= px; font-stretch: normal; font-size: 13px; line-height: normal; font-family= : "Helvetica Neue";">We are running TSVN with OpenIDC authenticat= ing with Entra ID (Azure AD), not through the Microsoft Azure Application P= roxy though.</div><div style=3D"margin: 0px; font-stretch: normal; font-siz= e: 13px; line-height: normal; font-family: "Helvetica Neue"; min-= height: 15px;"><br /></div><div style=3D"margin: 0px; font-stretch: normal;= font-size: 13px; line-height: normal; font-family: "Helvetica Neue&qu= ot;;">Server-side, we have Apache httpd as usual but we add the open-source= mod_openidc module (instead of basic auth). In addition, some rewrites and= other config that allows us to tunnel the session token in basic auth (whi= ch TSVN supports).=C2=A0</div><div style=3D"margin: 0px; font-stretch: norm= al; font-size: 13px; line-height: normal; font-family: "Helvetica Neue= "; min-height: 15px;"><br /></div><div style=3D"margin: 0px; font-stre= tch: normal; font-size: 13px; line-height: normal; font-family: "Helve= tica Neue";">We currently have an installed application that performs = the OpenIDC authentication and then inserts the session token in the svn au= th cache as a basic authentication.=C2=A0In order to achieve a cleaner impl= ementation that can also work with Microsoft Azure Application Proxy the se= ssion token must be sent as a cookie.</div><div style=3D"margin: 0px; font-= stretch: normal; font-size: 13px; line-height: normal; font-family: "H= elvetica Neue"; min-height: 15px;"><br /></div><div style=3D"margin: 0= px; font-stretch: normal; font-size: 13px; line-height: normal; font-family= : "Helvetica Neue";">We would be interested in contributing exper= ience, specifications and server setups if we can get the following stars a= ligned:</div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13= px; line-height: normal; font-family: "Helvetica Neue";">=C2=A0- = Financial / developer contributions=C2=A0</div><div style=3D"margin: 0px; f= ont-stretch: normal; font-size: 13px; line-height: normal; font-family: &qu= ot;Helvetica Neue";">=C2=A0- Subversion core committer interest=C2=A0<= /div><div style=3D"margin: 0px; font-stretch: normal; font-size: 13px; line= -height: normal; font-family: "Helvetica Neue";">=C2=A0- TSVN com= mitter interest</div></div></blockquote><div><br /></div><div>Hi,</div><div= ><br /></div><div>This sounds really interesting. I'm committer in both Sub= version and TSVN (and in Serf, if that would be necessary) and as long as t= hings are discussed in the appropriate -dev lists, I can sponsor the commit= s. Unfortunately I'm not in a position to contribute very much code, simply= because of a lack of time.</div><div><br /></div><blockquote style=3D"marg= in: 0px 0px 0px 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-l= eft: 1ex;"><div style=3D"overflow-wrap: break-word;"><p style=3D"margin: 0p= x; font-stretch: normal; font-size: 13px; line-height: normal; font-family:= "Helvetica Neue"; min-height: 15px;">=C2=A0<br /></p><div style= =3D"margin: 0px; font-stretch: normal; font-size: 13px; line-height: normal= ; font-family: "Helvetica Neue";">We also need to reach consensus= in primarily the Subversion project but there is relatively limited amount= s of changes that must happen there.=C2=A0</div><div style=3D"margin: 0px; = font-stretch: normal; font-size: 13px; line-height: normal; font-family: &q= uot;Helvetica Neue";">=C2=A0- Sending cookie header with session token= instead of basic auth.=C2=A0</div><div style=3D"margin: 0px; font-stretch:= normal; font-size: 13px; line-height: normal; font-family: "Helvetica= Neue";">=C2=A0- Capture set-cookie response headers related to refres= h of the session cookie.</div><div style=3D"margin: 0px; font-stretch: norm= al; font-size: 13px; line-height: normal; font-family: "Helvetica Neue= ";">=C2=A0- "svn auth" support for storing session token, very similar= to basic auth (cookie name and the token).=C2=A0</div></div></blockquote><= div><br /></div><div>These things doesn't sound all that complicated, but s= hould probably be discussed on [email protected]. Would you like to= bring this discussion over there?</div><div>=C2=A0</div><blockquote style= =3D"margin: 0px 0px 0px 0.8ex; border-left: 1px solid rgb(204, 204, 204); p= adding-left: 1ex;"><div style=3D"overflow-wrap: break-word;"><div style=3D"= margin: 0px; font-stretch: normal; font-size: 13px; line-height: normal; fo= nt-family: "Helvetica Neue";">=C2=A0- maybe something related to = handling redirect to ensure that TSVN can act on that</div></div></blockquo= te><div><br /></div><div>I presume we need to have a notification callback = function in Subversion that TSVN can catch to show the authentication webpa= ge, much like any other OAuth2 compatible application does, is this correct= ?</div><div>=C2=A0</div><blockquote style=3D"margin: 0px 0px 0px 0.8ex; bor= der-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div style=3D"o= verflow-wrap: break-word;"><div style=3D"margin: 0px; font-stretch: normal;= font-size: 13px; line-height: normal; font-family: "Helvetica Neue&qu= ot;; min-height: 15px;"><br /></div><div style=3D"margin: 0px; font-stretch= : normal; font-size: 13px; line-height: normal; font-family: "Helvetic= a Neue";">When that is in place, I believe it would be possible to hav= e a standalone helper application that performs the authentication and stor= es it using the "svn auth" subcommand (or equivalent). Alternatively add th= is support in TSVN which would be the ideal UX.</div><div style=3D"margin: = 0px; font-stretch: normal; font-size: 13px; line-height: normal; font-famil= y: "Helvetica Neue"; min-height: 15px;"><br /></div><div style=3D= "margin: 0px; font-stretch: normal; font-size: 13px; line-height: normal; f= ont-family: "Helvetica Neue";">Best regards,</div><div style=3D"m= argin: 0px; font-stretch: normal; font-size: 13px; line-height: normal; fon= t-family: "Helvetica Neue";">Thomas =C3=85.</div><div style=3D"ma= rgin: 0px; font-stretch: normal; font-size: 13px; line-height: normal; font= -family: "Helvetica Neue";"><br /></div><div><br /><blockquote ty= pe=3D"cite"></blockquote></div></div><div style=3D"overflow-wrap: break-wor= d;"><div><blockquote type=3D"cite"><div>On 20 Mar 2024, at 08:28, Daniel Sa= hlberg via TortoiseSVN-dev <<a href=3D"" rel=3D"nofollow">tortois...@goo= glegroups.com</a>> wrote:</div><br /></blockquote></div></div><div style= =3D"overflow-wrap: break-word;"><div><blockquote type=3D"cite"><div><span s= tyle=3D"font-family: Helvetica; font-size: 12px; font-style: normal; font-v= ariant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: = start; text-indent: 0px; text-transform: none; white-space: normal; word-sp= acing: 0px; text-decoration: none; float: none; display: inline;">From what= I understand, OAuth2 requires both server- and clientside support. So any = solution would need to involve both TortoiseSVN and the Subversion project = (or VisualSVN). I think it is a great idea but I think some additional deve= lopment resources would be required to make this happen. Any chance that yo= u (or your company) can get involved in making this happen?</span><div styl= e=3D"font-family: Helvetica; font-size: 12px; font-style: normal; font-vari= ant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: sta= rt; text-indent: 0px; text-transform: none; white-space: normal; word-spaci= ng: 0px; text-decoration: none;"><br /></div><div style=3D"font-family: Hel= vetica; font-size: 12px; font-style: normal; font-variant-caps: normal; fon= t-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px;= text-transform: none; white-space: normal; word-spacing: 0px; text-decorat= ion: none;">Kind regards,</div><div style=3D"font-family: Helvetica; font-s= ize: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400;= letter-spacing: normal; text-align: start; text-indent: 0px; text-transfor= m: none; white-space: normal; word-spacing: 0px; text-decoration: none;">Da= niel<br /><br /><div><div dir=3D"auto">onsdag 20 mars 2024 kl. 08:11:28 UTC= +1 skrev j...@<a href=3D"http://parabilis-space.com/" target=3D"_blank" rel= =3D"nofollow">parabilis-space.com</a>:<br /></div><blockquote style=3D"marg= in: 0px 0px 0px 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-l= eft: 1ex;"><p>We have run into a problem trying to implement SVN on our sec= ure cloud platform.=C2=A0 Is it possible to pay someone to add modern authe= ntication to TortoiseSVN?</p><p>=C2=A0Specifically we wish to use TortoiseS= VN client to access VisualSVN Server via Microsoft Azure Application Proxy.= =C2=A0 This requires TSVN to be conversant in "OAuth 2.0 with OpenID Connec= t (OIDC)".=C2=A0 See=C2=A0<a href=3D"https://auth0.com/docs/authenticate/pr= otocols/openid-connect-protocol" rel=3D"nofollow" target=3D"_blank">https:/= /auth0.com/docs/authenticate/protocols/openid-connect-protocol</a></p><p>Yo= u can see the error we get by using TortoiseSVN to open this test repositor= y<span>=C2=A0</span><a href=3D"https://visualsvn.parabilis-space.com/svn/te= st/" rel=3D"nofollow" target=3D"_blank">https://visualsvn.parabilis-space.c= om/svn/test/</a>=C2=A0<br /><span style=3D"font-family: Calibri, sans-serif= ; font-size: 11pt;">Error: Repository moved temporarily to ...Oath2/authori= ze...</span></p><div><br /></div><p>Thank You,<br /></p><p>--Jon<br /></p><= /blockquote></div></div><div style=3D"font-family: Helvetica; font-size: 12= px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter= -spacing: normal; text-align: start; text-indent: 0px; text-transform: none= ; white-space: normal; word-spacing: 0px; text-decoration: none;"><br /></d= iv></div></blockquote></div></div><div style=3D"overflow-wrap: break-word;"= ><div><blockquote type=3D"cite"><div><span style=3D"font-family: Helvetica;= font-size: 12px; font-style: normal; font-variant-caps: normal; font-weigh= t: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-t= ransform: none; white-space: normal; word-spacing: 0px; text-decoration: no= ne; float: none; display: inline;">--<span>=C2=A0</span></span><br style=3D= "font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-= caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; word-spacing: = 0px; text-decoration: none;" /><span style=3D"font-family: Helvetica; font-= size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400= ; letter-spacing: normal; text-align: start; text-indent: 0px; text-transfo= rm: none; white-space: normal; word-spacing: 0px; text-decoration: none; fl= oat: none; display: inline;">You received this message because you are subs= cribed to the Google Groups "TortoiseSVN-dev" group.</span><br style=3D"fon= t-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps= : normal; font-weight: 400; letter-spacing: normal; text-align: start; text= -indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;= text-decoration: none;" /><span style=3D"font-family: Helvetica; font-size= : 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; le= tter-spacing: normal; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; word-spacing: 0px; text-decoration: none; float:= none; display: inline;">To unsubscribe from this group and stop receiving = emails from it, send an email to<span>=C2=A0</span></span><a href=3D"" styl= e=3D"font-family: Helvetica; font-size: 12px; font-style: normal; font-vari= ant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: sta= rt; text-indent: 0px; text-transform: none; white-space: normal; word-spaci= ng: 0px;" rel=3D"nofollow">[email protected]</a><span style= =3D"font-family: Helvetica; font-size: 12px; font-style: normal; font-varia= nt-caps: normal; font-weight: 400; letter-spacing: normal; text-align: star= t; text-indent: 0px; text-transform: none; white-space: normal; word-spacin= g: 0px; text-decoration: none; float: none; display: inline;">.</span><br s= tyle=3D"font-family: Helvetica; font-size: 12px; font-style: normal; font-v= ariant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: = start; text-indent: 0px; text-transform: none; white-space: normal; word-sp= acing: 0px; text-decoration: none;" /><span style=3D"font-family: Helvetica= ; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weig= ht: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-= transform: none; white-space: normal; word-spacing: 0px; text-decoration: n= one; float: none; display: inline;">To view this discussion on the web visi= t<span>=C2=A0</span></span><a href=3D"https://groups.google.com/d/msgid/tor= toisesvn-dev/4dc5d482-62d0-4c7d-b375-9e1b5e467baan%40googlegroups.com?utm_m= edium=3Demail&utm_source=3Dfooter" style=3D"font-family: Helvetica; fon= t-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 4= 00; letter-spacing: normal; text-align: start; text-indent: 0px; text-trans= form: none; white-space: normal; word-spacing: 0px;" target=3D"_blank" rel= =3D"nofollow">https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-62= d0-4c7d-b375-9e1b5e467baan%40googlegroups.com</a><span style=3D"font-family= : Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal= ; font-weight: 400; letter-spacing: normal; text-align: start; text-indent:= 0px; text-transform: none; white-space: normal; word-spacing: 0px; text-de= coration: none; float: none; display: inline;">.</span></div></blockquote><= /div><br /></div></blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;TortoiseSVN-dev" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">tor= [email protected]</a>.<br /> To view this discussion on the web visit <a href=3D"https://groups.google.c= om/d/msgid/tortoisesvn-dev/00eb0964-485a-4c49-a73d-522745766195n%40googlegr= oups.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/= d/msgid/tortoisesvn-dev/00eb0964-485a-4c49-a73d-522745766195n%40googlegroup= s.com</a>.<br /> ------=_Part_40941_1548078580.1711716081320-- ------=_Part_40940_1242960193.1711716081320--