Use ASAB auth and tenant services #440

byewokko · 2025-02-12T18:19:04Z

Summary

Introduces custom TenantProvider for ASAB TenantService.
Introduces custom AuthProvider for ASAB AuthService.
Introduces custom Authorization for ASAB AuthService which also includes verified Seacat Session object.
Removes SessionContext, replace with asab.contextvars.Authz.
Introduces system_authz context manager for providing authorization in service-internal context (provisioning, maintenance...).
RbacService:
- uses access control functions from asab.web.auth.authorization.
- tenant softchecks are not supported.
- tenant access is done using a proper method, dummy resource "tenant:access" is not supported.

TODO

When request is authenticated using ASAB internal auth, there is no Seacat Auth session associated with it.
- Prepare system session
- Inject it into the context???

# Conflicts: # seacatauth/authz/role/service.py

byewokko · 2025-03-04T13:47:41Z

Dockerfile

@@ -45,7 +45,7 @@ RUN apk add --no-cache  \
    pyyaml \
    pymongo \
    sentry-sdk \
-    git+https://github.com/TeskaLabs/asab.git


remove this before merging

byewokko · 2025-03-04T16:43:02Z

.github/workflows/ci.yml

@@ -60,7 +60,7 @@ jobs:
        pip install bcrypt
        pip install argon2
        pip install jwcrypto
-        pip install git+https://github.com/TeskaLabs/asab.git#egg=asab[encryption]
+        pip install "asab[encryption] @ git+https://github.com/TeskaLabs/asab.git@feature/auth-providers"


remove dev branch before merging

ateska · 2025-03-11T11:47:22Z

seacatauth/auth_provider.py

+
+
+@contextlib.contextmanager
+def system_authz(


Proposed name: local_authz

ateska · 2025-03-11T11:50:36Z

seacatauth/authz/rbac/service.py



+# TODO: Deprecated. Replace with ASAB auth functions entirely.


Propose a date of when this code is to be removed ... or consider Deprecation at all.

byewokko added 12 commits February 12, 2025 15:13

add asab tenant and auth services with custom providers

7fe47d1

add asab tenant and auth services with custom providers

23f3163

use default args

1cc9fec

collect resource ids

0951f2f

use asab auth tools in authn

91f3cf7

deprecate the access_control decorator

e50451c

deprecate SessionContext

d9b7578

remove unused

af1aed4

use asab auth functions in rbac service

fb9b16f

use asab auth functions in rbac service

12cfe51

use asab auth functions in rbac service

55c7cd4

use asab auth tools in resource module

0284e94

byewokko added the enhancement New feature or request label Feb 12, 2025

byewokko self-assigned this Feb 12, 2025

byewokko added 16 commits February 13, 2025 11:28

use asab auth tools in role module

606c9e1

use asab auth functions in rbac service

343c085

Merge branch 'refs/heads/main' into feature/use-asab-auth

9853611

# Conflicts: # seacatauth/authz/role/service.py

use asab auth tools in role module

94f4ee5

use asab auth tools in cookie module

7d75a01

use asab auth tools in oidc module

3b76e04

use asab auth tools in session handler

2abe691

use asab auth tools in tenant handler

b96be90

use asab auth tools in cred handler

e958560

use asab auth tools in cred handlers

6843b3a

use asab auth tools in client handler

9926c8b

use asab auth tools in otp handler

c07443c

use asab auth tools in otp handler

ad27bd0

use asab auth tools in ext login handler

5f040b3

Merge branch 'main' into feature/use-asab-auth

dcae270

system_authz context

8b8d25f

byewokko added 15 commits February 27, 2025 12:45

remove empty files

5bcee92

Merge branch 'main' into feature/use-asab-auth

6febaaa

replace request variables with authz

e3df066

replace request variables with authz

3e9ac9c

replace request.Session with authz and explicit session retrieval

b5d0e51

get rid of obsolete handler args

e58eb57

fix typo

3708e23

remove unused

c8fc618

better legibility

05ea5c2

userinfo must work with sso cookie authentication

ceab8a9

fix service dependency

677f897

no auth at tenant endpoint

4020e23

less normal flow logging

e3885c5

change asab branch for testing

38b0b2a

fix imports

6b6831f

byewokko commented Mar 4, 2025

View reviewed changes

byewokko added 7 commits March 4, 2025 14:54

fix imports

fbde5cb

fix imports

1b0cf83

temporarily use asab branch for test

b7d9277

temporarily use asab branch for test

1031b49

fix import

e386d82

add tenant check method

be8a5a7

deprecate tenant softchecks, replace tenant="*" with tenant=None

d55c64e

byewokko commented Mar 4, 2025

View reviewed changes

byewokko added 2 commits March 5, 2025 10:46

missing decorators in batman handler

6666585

Merge branch 'main' into feature/use-asab-auth

aa0e8a5

ateska requested changes Mar 11, 2025

View reviewed changes

byewokko added 3 commits March 12, 2025 11:19

rename local_authz

9bc02f6

move auth and tenant provider into new api module

e9b52d5

rename local_authz

93ba943

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use ASAB auth and tenant services #440

Use ASAB auth and tenant services #440

byewokko commented Feb 12, 2025 •

edited

Loading

byewokko Mar 4, 2025

byewokko Mar 4, 2025

ateska Mar 11, 2025

ateska Mar 11, 2025



		# TODO: Deprecated. Replace with ASAB auth functions entirely.



		@contextlib.contextmanager
		def system_authz(

Use ASAB auth and tenant services #440

Are you sure you want to change the base?

Use ASAB auth and tenant services #440

Conversation

byewokko commented Feb 12, 2025 • edited Loading

Summary

TODO

byewokko Mar 4, 2025

Choose a reason for hiding this comment

byewokko Mar 4, 2025

Choose a reason for hiding this comment

ateska Mar 11, 2025

Choose a reason for hiding this comment

ateska Mar 11, 2025

Choose a reason for hiding this comment

byewokko commented Feb 12, 2025 •

edited

Loading