1354589 - (bmo-oauth) Implement OAuth2 on BMO

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: API, enhancement, P1)

Description

[Dylan Hardison [:dylan] (he/him)]

Notes for a possible implementation

- use OAuth::Lite2
- add oauth.cgi endpoint that just wraps PSGI app https://metacpan.org/pod/OAuth::Lite2::Server::Endpoint::Token
- Implement Bugzilla::OAuth::DataHandler as subclass of https://metacpan.org/pod/OAuth::Lite2::Server::DataHandler
- Implement Bugzilla::OAuth::AuthInfo objects
- Implement Bugzilla::OAuth::AccessToken, subclass of https://metacpan.org/pod/OAuth::Lite2::Model::AccessToken which will contain a Bugzilla::User::APIKey object.
- Wrap (conditionally?) rest.cgi with Plack::Middleware::Auth::OAuth2::ProtectedResource and poke at auth code to use this for authentication (really, just adapting what an oauth-client will be sending to the API keys).

Not going to estimate this right now, it's a decent amount of work but not to the level that implementing our own crappy auth.cgi system.

Comment 1

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

What's the driver for OAuth2? Compatibility? Requirements from another group?

Comment 2

[Mark Côté [:mcote]]

As discussed, this will mainly be for eventual Auth0 support.  Having a standard auth solution (as opposed to our custom API keys/auth delegation) would be nice too but not a priority.

Comment 3

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

Backlogging this for now.

Getting a sizing on it and a date for when we'd need to support Auth0 would be useful.

Comment 4

[David Lawrence [:dkl]]

Attachment: GitHub Pull Request

Comment 5

[Dylan Hardison [:dylan] (he/him)]

Attachment: Schema Changes

Comment 6

[Dylan Hardison [:dylan] (he/him)]

Attachment: Client Admin

Comment 7

[Dylan Hardison [:dylan] (he/him)]

Attachment: OAuth Plugin