OpenID Connect support for authorization code seems to be incomplete

[Alvaro Lopez]

The OpenID Connect support for the "authorization code" grant type requires two steps for obtaining an access token.

1.- An authorization code needs to be obtained from the authorization endpoint.
2.- The authorization code is exchanged with the access token endpoint to obtain an access token.

Currently, the oidc plugin only implements 2. Moreover, the authorization code a single-use secret, so it seems that support is incomplete, as the user must obtain a new auth. code each time.

[Steve Martinelli (stevemar)]

OK, I get the problem... a user gets the authorization codes via a browser, the codes are one-time use. If used via openstackclient, these authorization codes are used up after every command. So the user would have to get a user authorization code after every osc command. definitely not ideal!

[Steve Martinelli (stevemar)]

first attempt: https://review.openstack.org/#/c/330006/1

[Alvaro Lopez (aloga)]

@Steve, that's it. If the user is accessing OpenStack 100 times, 100 browser tabs/windows will be opened. In most cases authentication will be done manually (i.e. log in) only once, as subsequent requests will be authenticated if the user does not log out.

The access token can be reused (as long as it is still valid), so the only way to not ask for authentication each time is to persist the access token from session to session and detect if a valid token is there. The token can be persisted to disk but this may have security concerns.

[Lance Bragstad (lbragstad)]

Automatically unassigning due to inactivity.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Alvaro Lopez Garcia (<email address hidden>) on branch: master
Review: https://review.openstack.org/330006
Reason: Lets abandon this until I try to figure out what the best (or correct) approach would be.

[Alvaro Lopez (aloga)]

Reassigning this to me, as the bug is still valid. The inactivity on the bug itself is not due to actual inactivity, but due to discussions going in the background...

[Lance Bragstad (lbragstad)]

Alvaro,

Do you have any update on the discussions needed to solve this? If there is something we need to come to consensus on as a group, please feel free to add it to the agenda for the weekly keystone meeting [0].

[0] https://etherpad.openstack.org/p/keystone-weekly-meeting

[Lance Bragstad (lbragstad)]

Automatically unassigning due to inactivity.

[wondra (wondra)]

I suggest to get inpiration from https://github.com/int128/kubelogin. They implement the Authorization Code flow correctly and include a local cache of the received token.