Re: Add modern authentication (OAuth 2.0 + OIDC) to TortoiseSVN
Jon Martin via TortoiseSVN-dev <[email protected]> Wed, 10 Apr 2024 14:43:56 -0700 (PDT)
| Newsgroups | gmane.comp.version-control.subversion.tortoisesvn.devel |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_54634_1498434935.1712785436253 Content-Type: multipart/alternative; boundary="----=_Part_54635_387461790.1712785436253" ------=_Part_54635_387461790.1712785436253 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thomas =C3=85. While we wait on TortoiseSVN improvements, what is the "ap= plication=20 that performs the OpenIDC authentication" you use on the TortoiseSVN side?= =20 Thanks, --Jon On Friday, March 29, 2024 at 2:02:33=E2=80=AFAM UTC-7 Thomas =C3=85kesson w= rote: > Hi Jon and Daniel, > > Sorry about the late response.=20 > > We are running TSVN with OpenIDC authenticating with Entra ID (Azure AD),= =20 > not through the Microsoft Azure Application Proxy though. > > Server-side, we have Apache httpd as usual but we add the open-source=20 > mod_openidc module (instead of basic auth). In addition, some rewrites an= d=20 > other config that allows us to tunnel the session token in basic auth=20 > (which TSVN supports).=20 > > We currently have an installed application that performs the OpenIDC=20 > authentication and then inserts the session token in the svn auth cache a= s=20 > a basic authentication. In order to achieve a cleaner implementation that= =20 > can also work with Microsoft Azure Application Proxy the session token mu= st=20 > be sent as a cookie. > > We would be interested in contributing experience, specifications and=20 > server setups if we can get the following stars aligned: > - Financial / developer contributions=20 > - Subversion core committer interest=20 > - TSVN committer interest > > =20 > We also need to reach consensus in primarily the Subversion project but= =20 > there is relatively limited amounts of changes that must happen there.=20 > - Sending cookie header with session token instead of basic auth.=20 > - Capture set-cookie response headers related to refresh of the session= =20 > cookie. > - "svn auth" support for storing session token, very similar to basic=20 > auth (cookie name and the token).=20 > - maybe something related to handling redirect to ensure that TSVN can= =20 > act on that > > When that is in place, I believe it would be possible to have a standalon= e=20 > helper application that performs the authentication and stores it using t= he=20 > "svn auth" subcommand (or equivalent). Alternatively add this support in= =20 > TSVN which would be the ideal UX. > > Best regards, > Thomas =C3=85. > > > On 20 Mar 2024, at 08:28, Daniel Sahlberg via TortoiseSVN-dev < > [email protected]> wrote: > > From what I understand, OAuth2 requires both server- and clientside=20 > support. So any solution would need to involve both TortoiseSVN and the= =20 > Subversion project (or VisualSVN). I think it is a great idea but I think= =20 > some additional development resources would be required to make this=20 > happen. Any chance that you (or your company) can get involved in making= =20 > this happen? > > Kind regards, > Daniel > > onsdag 20 mars 2024 kl. 08:11:28 UTC+1 skrev [email protected]: > > We have run into a problem trying to implement SVN on our secure cloud=20 > platform. Is it possible to pay someone to add modern authentication to= =20 > TortoiseSVN? > > Specifically we wish to use TortoiseSVN client to access VisualSVN Serve= r=20 > via Microsoft Azure Application Proxy. This requires TSVN to be conversa= nt=20 > in "OAuth 2.0 with OpenID Connect (OIDC)". See=20 > https://auth0.com/docs/authenticate/protocols/openid-connect-protocol > > You can see the error we get by using TortoiseSVN to open this test=20 > repository https://visualsvn.parabilis-space.com/svn/test/=20 > Error: Repository moved temporarily to ...Oath2/authorize... > > Thank You, > > --Jon > > > --=20 > You received this message because you are subscribed to the Google Groups= =20 > "TortoiseSVN-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an= =20 > email to [email protected]. > To view this discussion on the web visit=20 > https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-62d0-4c7d-b375= -9e1b5e467baan%40googlegroups.com=20 > <https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-62d0-4c7d-b37= 5-9e1b5e467baan%40googlegroups.com?utm_medium=3Demail&utm_source=3Dfooter> > . > > > --=20 You received this message because you are subscribed to the Google Groups "= TortoiseSVN-dev" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/= tortoisesvn-dev/d32430e9-f95c-49d5-bed0-5511bd6893f7n%40googlegroups.com. ------=_Part_54635_387461790.1712785436253 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thomas =C3=85. While we wait on=C2=A0<span style=3D"font-size: 11pt; font= -family: Aptos, serif;">TortoiseSVN</span>=C2=A0=C2=A0improvements, what is= the=C2=A0 "<span style=3D"font-family: "Helvetica Neue"; font-si= ze: 13px;">application that performs the OpenIDC authentication</span>" you= use on the=C2=A0<span style=3D"font-size: 11pt; font-family: Aptos, serif;= ">TortoiseSVN</span>=C2=A0=C2=A0side?=C2=A0<div>Thanks, --Jon<br /><br /></= div><div class=3D"gmail_quote"><div dir=3D"auto" class=3D"gmail_attr">On Fr= iday, March 29, 2024 at 2:02:33=E2=80=AFAM UTC-7 Thomas =C3=85kesson wrote:= <br/></div><blockquote class=3D"gmail_quote" style=3D"margin: 0 0 0 0.8ex; = border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div style= =3D"word-wrap:break-word;line-break:after-white-space"><div style=3D"margin= :0px;font-stretch:normal;font-size:13px;line-height:normal;font-family:&quo= t;Helvetica Neue"">Hi Jon and Daniel,</div><div style=3D"margin:0px;fo= nt-stretch:normal;font-size:13px;line-height:normal;font-family:"Helve= tica Neue";min-height:15px"><br></div><div style=3D"margin:0px;font-st= retch:normal;font-size:13px;line-height:normal;font-family:"Helvetica = Neue"">Sorry about the late response.=C2=A0</div><div style=3D"margin:= 0px;font-stretch:normal;font-size:13px;line-height:normal;font-family:"= ;Helvetica Neue";min-height:15px"><br></div><div style=3D"margin:0px;f= ont-stretch:normal;font-size:13px;line-height:normal;font-family:"Helv= etica Neue"">We are running TSVN with OpenIDC authenticating with Entr= a ID (Azure AD), not through the Microsoft Azure Application Proxy though.<= /div><div style=3D"margin:0px;font-stretch:normal;font-size:13px;line-heigh= t:normal;font-family:"Helvetica Neue";min-height:15px"><br></div>= <div style=3D"margin:0px;font-stretch:normal;font-size:13px;line-height:nor= mal;font-family:"Helvetica Neue"">Server-side, we have Apache htt= pd as usual but we add the open-source mod_openidc module (instead of basic= auth). In addition, some rewrites and other config that allows us to tunne= l the session token in basic auth (which TSVN supports).=C2=A0</div><div st= yle=3D"margin:0px;font-stretch:normal;font-size:13px;line-height:normal;fon= t-family:"Helvetica Neue";min-height:15px"><br></div><div style= =3D"margin:0px;font-stretch:normal;font-size:13px;line-height:normal;font-f= amily:"Helvetica Neue"">We currently have an installed applicatio= n that performs the OpenIDC authentication and then inserts the session tok= en in the svn auth cache as a basic authentication.=C2=A0In order to achiev= e a cleaner implementation that can also work with Microsoft Azure Applicat= ion Proxy the session token must be sent as a cookie.</div><div style=3D"ma= rgin:0px;font-stretch:normal;font-size:13px;line-height:normal;font-family:= "Helvetica Neue";min-height:15px"><br></div><div style=3D"margin:= 0px;font-stretch:normal;font-size:13px;line-height:normal;font-family:"= ;Helvetica Neue"">We would be interested in contributing experience, s= pecifications and server setups if we can get the following stars aligned:<= /div><div style=3D"margin:0px;font-stretch:normal;font-size:13px;line-heigh= t:normal;font-family:"Helvetica Neue"">=C2=A0- Financial / develo= per contributions=C2=A0</div><div style=3D"margin:0px;font-stretch:normal;f= ont-size:13px;line-height:normal;font-family:"Helvetica Neue"">= =C2=A0- Subversion core committer interest=C2=A0</div><div style=3D"margin:= 0px;font-stretch:normal;font-size:13px;line-height:normal;font-family:"= ;Helvetica Neue"">=C2=A0- TSVN committer interest</div><p style=3D"mar= gin:0px;font-stretch:normal;font-size:13px;line-height:normal;font-family:&= quot;Helvetica Neue";min-height:15px">=C2=A0<br></p><div style=3D"marg= in:0px;font-stretch:normal;font-size:13px;line-height:normal;font-family:&q= uot;Helvetica Neue"">We also need to reach consensus in primarily the = Subversion project but there is relatively limited amounts of changes that = must happen there.=C2=A0</div><div style=3D"margin:0px;font-stretch:normal;= font-size:13px;line-height:normal;font-family:"Helvetica Neue"">= =C2=A0- Sending cookie header with session token instead of basic auth.=C2= =A0</div><div style=3D"margin:0px;font-stretch:normal;font-size:13px;line-h= eight:normal;font-family:"Helvetica Neue"">=C2=A0- Capture set-co= okie response headers related to refresh of the session cookie.</div><div s= tyle=3D"margin:0px;font-stretch:normal;font-size:13px;line-height:normal;fo= nt-family:"Helvetica Neue"">=C2=A0- "svn auth" support = for storing session token, very similar to basic auth (cookie name and the = token).=C2=A0</div><div style=3D"margin:0px;font-stretch:normal;font-size:1= 3px;line-height:normal;font-family:"Helvetica Neue"">=C2=A0- mayb= e something related to handling redirect to ensure that TSVN can act on tha= t</div><div style=3D"margin:0px;font-stretch:normal;font-size:13px;line-hei= ght:normal;font-family:"Helvetica Neue";min-height:15px"><br></di= v><div style=3D"margin:0px;font-stretch:normal;font-size:13px;line-height:n= ormal;font-family:"Helvetica Neue"">When that is in place, I beli= eve it would be possible to have a standalone helper application that perfo= rms the authentication and stores it using the "svn auth" subcomm= and (or equivalent). Alternatively add this support in TSVN which would be = the ideal UX.</div><div style=3D"margin:0px;font-stretch:normal;font-size:1= 3px;line-height:normal;font-family:"Helvetica Neue";min-height:15= px"><br></div><div style=3D"margin:0px;font-stretch:normal;font-size:13px;l= ine-height:normal;font-family:"Helvetica Neue"">Best regards,</di= v><div style=3D"margin:0px;font-stretch:normal;font-size:13px;line-height:n= ormal;font-family:"Helvetica Neue"">Thomas =C3=85.</div><div styl= e=3D"margin:0px;font-stretch:normal;font-size:13px;line-height:normal;font-= family:"Helvetica Neue""><br></div><div><br><blockquote type=3D"c= ite"></blockquote></div></div><div style=3D"word-wrap:break-word;line-break= :after-white-space"><div><blockquote type=3D"cite"><div>On 20 Mar 2024, at = 08:28, Daniel Sahlberg via TortoiseSVN-dev <<a href data-email-masked re= l=3D"nofollow">[email protected]</a>> wrote:</div><br></blockq= uote></div></div><div style=3D"word-wrap:break-word;line-break:after-white-= space"><div><blockquote type=3D"cite"><div><span style=3D"font-family:Helve= tica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:= 400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:n= one;white-space:normal;word-spacing:0px;text-decoration:none;float:none;dis= play:inline!important">From what I understand, OAuth2 requires both server-= and clientside support. So any solution would need to involve both Tortois= eSVN and the Subversion project (or VisualSVN). I think it is a great idea = but I think some additional development resources would be required to make= this happen. Any chance that you (or your company) can get involved in mak= ing this happen?</span><div style=3D"font-family:Helvetica;font-size:12px;f= ont-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:no= rmal;text-align:start;text-indent:0px;text-transform:none;white-space:norma= l;word-spacing:0px;text-decoration:none"><br></div><div style=3D"font-famil= y:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-= weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-tran= sform:none;white-space:normal;word-spacing:0px;text-decoration:none">Kind r= egards,</div><div style=3D"font-family:Helvetica;font-size:12px;font-style:= normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-= align:start;text-indent:0px;text-transform:none;white-space:normal;word-spa= cing:0px;text-decoration:none">Daniel<br><br><div><div dir=3D"auto">onsdag = 20 mars 2024 kl. 08:11:28 UTC+1 skrev j...@<a href=3D"http://parabilis-spac= e.com/" target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https://= www.google.com/url?hl=3Den&q=3Dhttp://parabilis-space.com/&source= =3Dgmail&ust=3D1712871577288000&usg=3DAOvVaw0vlByQ-a88IPBhUAX42Ap2"= >parabilis-space.com</a>:<br></div><blockquote style=3D"margin:0px 0px 0px = 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(2= 04,204,204);padding-left:1ex"><p>We have run into a problem trying to imple= ment SVN on our secure cloud platform.=C2=A0 Is it possible to pay someone = to add modern authentication to TortoiseSVN?</p><p>=C2=A0Specifically we wi= sh to use TortoiseSVN client to access VisualSVN Server via Microsoft Azure= Application Proxy.=C2=A0 This requires TSVN to be conversant in "OAut= h 2.0 with OpenID Connect (OIDC)".=C2=A0 See=C2=A0<a href=3D"https://a= uth0.com/docs/authenticate/protocols/openid-connect-protocol" rel=3D"nofoll= ow" target=3D"_blank" data-saferedirecturl=3D"https://www.google.com/url?hl= =3Den&q=3Dhttps://auth0.com/docs/authenticate/protocols/openid-connect-= protocol&source=3Dgmail&ust=3D1712871577288000&usg=3DAOvVaw1Ydp= jKMmbjo5xuYGtN0_l-">https://auth0.com/docs/authenticate/protocols/openid-co= nnect-protocol</a></p><p>You can see the error we get by using TortoiseSVN = to open this test repository<span>=C2=A0</span><a href=3D"https://visualsvn= .parabilis-space.com/svn/test/" rel=3D"nofollow" target=3D"_blank" data-saf= eredirecturl=3D"https://www.google.com/url?hl=3Den&q=3Dhttps://visualsv= n.parabilis-space.com/svn/test/&source=3Dgmail&ust=3D17128715772880= 00&usg=3DAOvVaw0g03RvYrBKQzoBCRlAxi3c">https://visualsvn.parabilis-spac= e.com/svn/test/</a>=C2=A0<br><span style=3D"font-family:Calibri,sans-serif;= font-size:11pt">Error: Repository moved temporarily to ...Oath2/authorize..= .</span></p><div><br></div><p>Thank You,<br></p><p>--Jon<br></p></blockquot= e></div></div><div style=3D"font-family:Helvetica;font-size:12px;font-style= :normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text= -align:start;text-indent:0px;text-transform:none;white-space:normal;word-sp= acing:0px;text-decoration:none"><br></div></div></blockquote></div></div><d= iv style=3D"word-wrap:break-word;line-break:after-white-space"><div><blockq= uote type=3D"cite"><div><span style=3D"font-family:Helvetica;font-size:12px= ;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:= normal;text-align:start;text-indent:0px;text-transform:none;white-space:nor= mal;word-spacing:0px;text-decoration:none;float:none;display:inline!importa= nt">--<span>=C2=A0</span></span><br style=3D"font-family:Helvetica;font-siz= e:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-sp= acing:normal;text-align:start;text-indent:0px;text-transform:none;white-spa= ce:normal;word-spacing:0px;text-decoration:none"><span style=3D"font-family= :Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-w= eight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-trans= form:none;white-space:normal;word-spacing:0px;text-decoration:none;float:no= ne;display:inline!important">You received this message because you are subs= cribed to the Google Groups "TortoiseSVN-dev" group.</span><br st= yle=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-variant-= caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-ind= ent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decora= tion:none"><span style=3D"font-family:Helvetica;font-size:12px;font-style:n= ormal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-a= lign:start;text-indent:0px;text-transform:none;white-space:normal;word-spac= ing:0px;text-decoration:none;float:none;display:inline!important">To unsubs= cribe from this group and stop receiving emails from it, send an email to<s= pan>=C2=A0</span></span><a href style=3D"font-family:Helvetica;font-size:12= px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacin= g:normal;text-align:start;text-indent:0px;text-transform:none;white-space:n= ormal;word-spacing:0px" data-email-masked rel=3D"nofollow">tortoisesvn-d...= @googlegroups.com</a><span style=3D"font-family:Helvetica;font-size:12px;fo= nt-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:nor= mal;text-align:start;text-indent:0px;text-transform:none;white-space:normal= ;word-spacing:0px;text-decoration:none;float:none;display:inline!important"= >.</span><br style=3D"font-family:Helvetica;font-size:12px;font-style:norma= l;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align= :start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:= 0px;text-decoration:none"><span style=3D"font-family:Helvetica;font-size:12= px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacin= g:normal;text-align:start;text-indent:0px;text-transform:none;white-space:n= ormal;word-spacing:0px;text-decoration:none;float:none;display:inline!impor= tant">To view this discussion on the web visit<span>=C2=A0</span></span><a = href=3D"https://groups.google.com/d/msgid/tortoisesvn-dev/4dc5d482-62d0-4c7= d-b375-9e1b5e467baan%40googlegroups.com?utm_medium=3Demail&utm_source= =3Dfooter" style=3D"font-family:Helvetica;font-size:12px;font-style:normal;= font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:s= tart;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0p= x" target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.g= oogle.com/url?hl=3Den&q=3Dhttps://groups.google.com/d/msgid/tortoisesvn= -dev/4dc5d482-62d0-4c7d-b375-9e1b5e467baan%2540googlegroups.com?utm_medium%= 3Demail%26utm_source%3Dfooter&source=3Dgmail&ust=3D1712871577288000= &usg=3DAOvVaw17OVK7OwCp8Kw4-pRX8ybs">https://groups.google.com/d/msgid/= tortoisesvn-dev/4dc5d482-62d0-4c7d-b375-9e1b5e467baan%40googlegroups.com</a= ><span style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font= -variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start= ;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;te= xt-decoration:none;float:none;display:inline!important">.</span></div></blo= ckquote></div><br></div></blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;TortoiseSVN-dev" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">tor= [email protected]</a>.<br /> To view this discussion on the web visit <a href=3D"https://groups.google.c= om/d/msgid/tortoisesvn-dev/d32430e9-f95c-49d5-bed0-5511bd6893f7n%40googlegr= oups.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/= d/msgid/tortoisesvn-dev/d32430e9-f95c-49d5-bed0-5511bd6893f7n%40googlegroup= s.com</a>.<br /> ------=_Part_54635_387461790.1712785436253-- ------=_Part_54634_1498434935.1712785436253--