Document the STS flow #7639

guy-har · 2024-04-08T10:44:18Z

No description provided.

github-actions · 2024-04-08T10:44:31Z

No linked issues found. Please add the corresponding issues in the pull request description.
Use GitHub automation to close the issue when a PR is merged

github-actions · 2024-04-08T10:45:27Z

♻️ PR Preview c877af6 has been successfully destroyed since this PR has been closed.

_{🤖 By surge-preview}

github-actions · 2024-04-08T10:48:24Z

E2E Test Results - DynamoDB Local - Local Block Adapter

Isan-Rivkin · 2024-04-09T08:04:33Z

docs/reference/security/sts-login.md

+
+# STS Login
+
+Secure Token Service (STS) authentication in lakeFS allows users to authenticate via an Identity Provider (IdP), using a secure and efficient method.


Suggested change

Secure Token Service (STS) authentication in lakeFS allows users to authenticate via an Identity Provider (IdP), using a secure and efficient method.

Secure Token Service (STS) authentication in lakeFS allows users to authenticate via an Identity Provider (IdP), using OIDC Authentication workflow.

Isan-Rivkin · 2024-04-09T08:05:11Z

docs/reference/security/sts-login.md

+{: .note}
+> The architecture does include the steps to generate the code using the remote authenticator. this should be done prior to the STS login flow.
+> There is a sample implementation to generate the code, redirect_uri and state at the end of this document.


This is more relevant as a stand alone section "pre-requisite"

What would you suggest?

Adding a pre-requisite section or a title in that same section explaining you must have access to an OIDC provider and literally that text.
just making it more clear what is expected

docs/reference/security/sts-login.md

talSofer · 2024-04-10T13:03:30Z

docs/reference/security/sts-login.md

+Secure Token Service (STS) authentication in lakeFS allows users to authenticate via an Identity Provider (IdP), using OIDC Authentication workflow.
+This document outlines the process, from setting up the STS authentication flow to integrating with lakeFS through the [high-level Python SDK](../../integrations/python.md).
+
+## Architecture


WDYT about moving the architecture section to the end of the page? this way we start with the "how to" and whoever is more interested in the details can continue reading

How about before the Sample implementation?

Sounds good!

talSofer · 2024-04-10T13:06:08Z

docs/reference/security/sts-login.md

+## Architecture
+
+{: .note}
+> The architecture does include the steps to generate the code using the remote authenticator. this should be done prior to the STS login flow.


The architecture does include the steps to generate the code using the remote authenticator.

The context for this sentence is not clear, can you please explain what was the intent?

Changed, PTAL

talSofer · 2024-04-10T13:07:15Z

docs/reference/security/sts-login.md

+- lakeFS Client: Initiates the authentication process by providing IdP credentials.
+- lakeFS Server: Facilitates the authentication request between the client and the remote authenticator.
+- Remote Authenticator: Acts as a bridge between lakeFS and the IdP, handling credential validation.
+- IdP (Identity Provider): Validates the provided credentials and returns the authentication status.


great section, thanks!

talSofer · 2024-04-10T13:08:19Z

docs/reference/security/sts-login.md

+
+## Configuration
+
+To enable STS authentication, configure your lakeFS instance with the appropriate endpoint to the external Authentication Service.


Suggested change

To enable STS authentication, configure your lakeFS instance with the appropriate endpoint to the external Authentication Service.

To enable STS authentication, configure your lakeFS instance with the endpoint of the external Authentication Service.

talSofer · 2024-04-10T13:09:41Z

docs/reference/security/sts-login.md

+
+
+## Sample implementation to generate the code, redirect_uri and state
+The following code snippet demonstrates how to generate the code, redirect_uri and state values that are required to initiate a new client session using the STS login feature.


nit; missing whitespace

talSofer · 2024-04-10T13:17:22Z

docs/reference/security/sts-login.md

+Ensure you replace <url-to-remote-authenticator-endpoint> with the actual URL of your Authentication Service.
+
+
+## STS Login with high level python client


IMO the order of actions a user needs to take is not 100% clear.
Can you create a numbered list of steps for configuration to a successful login?

Sounds like a good idea, I'm not really sure how to do that, Add a previous section with steps and links?
One concern I do have with the steps is that (I'm assuming) the user configuring and the user using the log in with the high level python client are not the same user, also the configuration is a one time thing and the login is not, @talSofer WDYT? is it even a concern?

One concern I do have with the steps is that (I'm assuming) the user configuring and the user using the log in with the high level python client are not the same user

that's a good point.

If we keep Configuration separate from Usage, how many steps there are before you can run the Python snippet?

Only the steps for generating the code and state which is up to the client to configure in the way they want. so basically there are three separate independent (almost) steps

configuration

generating the code and state - which is up to the client but we have provided a sample code of how to do that

generate client with the python wrapper (two lines of code)

talSofer · 2024-04-10T13:20:31Z

docs/reference/security/sts-login.md

+
+```python
+import lakefs
+myclient = lakefs.client.from_web_identity(code = '', redirect_uri = '', state = '' , ttl_seconds = 7200)


empty strings are confusing here; I should use what I get from the remote authenticator, right?

No, from the Identity provider. changing

talSofer · 2024-04-10T13:21:29Z

docs/reference/security/sts-login.md

+```
+
+
+## Sample implementation to generate the code, redirect_uri and state


Why do we need to include sample code?

Because it makes it more obvious what exactly I need to provide and it gives the user something to play with
This example is provided for auth0 but with a slight change it will work for other providers as well (I verified it on entra as well)

Co-authored-by: talSofer <tal.sofer@treeverse.io>

guy-har · 2024-04-10T13:55:27Z

@talSofer changed and commented PTAL 🙏

Co-authored-by: talSofer <tal.sofer@treeverse.io>

docs/reference/security/sts-login.md

talSofer · 2024-04-11T07:34:14Z

docs/reference/security/sts-login.md

+
+## STS Login with high level python client
+
+The Python client simplifies initiating a client session with STS login. Use the following example to start a new session:


Maybe can change this sentence to highlight that the high-level Python client is THE way to do STS login ?

talSofer · 2024-04-11T07:36:50Z

docs/reference/security/sts-login.md

+
+{: .note}
+> The architecture documentation begins at the stage following the generation of the code by the remote authenticator.
+> Please be aware that the preliminary steps, including the code generation process that takes place between the user and their identity provider, are not included in this documentation.


I think that we should include this step in this guide. even if not with specific instructions. the goal is to understand when I need to take every step.
maybe this should be step 1 in sts login? WDYT?

talSofer · 2024-04-11T07:37:14Z

docs/reference/security/sts-login.md

+## Architecture
+
+{: .note}
+> The architecture documentation begins at the stage following the generation of the code by the remote authenticator.


Suggested change

> The architecture documentation begins at the stage following the generation of the code by the remote authenticator.

> The architecture documentation begins at the stage after the generation of the code by the remote authenticator.

talSofer · 2024-04-11T07:44:37Z

docs/reference/security/sts-login.md

+> STS Login is available in lakeFS Cloud and lakeFS Enterprise. currently only tested on lakeFS Enterprise.
+
+Secure Token Service (STS) authentication in lakeFS enables users to authenticate to lakeFS using temporary credentials obtained from an Identity Provider (IdP) via the OpenID Connect (OIDC) Authentication workflow..
+This document outlines the process, from setting up the STS authentication flow to using temporary credentials to interact with lakeFS through the [high-level Python SDK](../../integrations/python.md).


Suggested change

This document outlines the process, from setting up the STS authentication flow to using temporary credentials to interact with lakeFS through the [high-level Python SDK](../../integrations/python.md).

This document outlines the process, from enabling STS authentication to using temporary credentials to interact with lakeFS through the [high-level Python SDK](../../integrations/python.md).

Co-authored-by: talSofer <tal.sofer@treeverse.io>

talSofer

Looks good, Thank you!

Document the STS flow

1a43b49

guy-har requested a review from Isan-Rivkin April 8, 2024 10:44

Isan-Rivkin requested changes Apr 9, 2024

View reviewed changes

Code review chages

8adce23

guy-har requested a review from Isan-Rivkin April 9, 2024 15:00

guy-har added exclude-changelog PR description should not be included in next release changelog minor-change Used for PRs that don't require issue attached labels Apr 9, 2024

guy-har requested review from ozkatz and talSofer April 9, 2024 15:21

guy-har marked this pull request as ready for review April 9, 2024 15:22

Isan-Rivkin approved these changes Apr 10, 2024

View reviewed changes

talSofer reviewed Apr 10, 2024

View reviewed changes

guy-har and others added 2 commits April 10, 2024 16:24

Update docs/reference/security/sts-login.md

c79f252

Co-authored-by: talSofer <tal.sofer@treeverse.io>

code review changes

31215d9

Update docs/reference/security/sts-login.md

5336f8a

Co-authored-by: talSofer <tal.sofer@treeverse.io>

talSofer reviewed Apr 11, 2024

View reviewed changes

guy-har and others added 2 commits April 11, 2024 10:46

Update docs/reference/security/sts-login.md

d220c56

Co-authored-by: talSofer <tal.sofer@treeverse.io>

Code review chages

c877af6

guy-har requested a review from talSofer April 11, 2024 08:17

talSofer approved these changes Apr 11, 2024

View reviewed changes

guy-har merged commit 0bd9aa9 into master Apr 11, 2024
37 checks passed

guy-har deleted the docs/sts-login branch April 11, 2024 10:31

emulatorchen pushed a commit to emulatorchen/lakeFS that referenced this pull request May 27, 2024

Document the STS flow (treeverse#7639)

e0a13c1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Document the STS flow #7639

Document the STS flow #7639

guy-har commented Apr 8, 2024

github-actions bot commented Apr 8, 2024

github-actions bot commented Apr 8, 2024 •

edited

Loading

github-actions bot commented Apr 8, 2024 •

edited

Loading

Isan-Rivkin Apr 9, 2024

Isan-Rivkin Apr 9, 2024

guy-har Apr 9, 2024

Isan-Rivkin Apr 10, 2024

talSofer Apr 10, 2024

guy-har Apr 10, 2024

talSofer Apr 10, 2024

talSofer Apr 10, 2024

guy-har Apr 10, 2024

talSofer Apr 10, 2024

talSofer Apr 10, 2024

talSofer Apr 10, 2024

talSofer Apr 10, 2024

guy-har Apr 10, 2024

talSofer Apr 10, 2024

guy-har Apr 11, 2024

talSofer Apr 10, 2024

guy-har Apr 10, 2024 •

edited

Loading

talSofer Apr 10, 2024

talSofer Apr 10, 2024

guy-har Apr 10, 2024

guy-har commented Apr 10, 2024

talSofer Apr 11, 2024

talSofer Apr 11, 2024

talSofer Apr 11, 2024

talSofer Apr 11, 2024

talSofer left a comment


		# STS Login

		Secure Token Service (STS) authentication in lakeFS allows users to authenticate via an Identity Provider (IdP), using a secure and efficient method.


		## Configuration

		To enable STS authentication, configure your lakeFS instance with the appropriate endpoint to the external Authentication Service.



		## Sample implementation to generate the code, redirect_uri and state
		The following code snippet demonstrates how to generate the code, redirect_uri and state values that are required to initiate a new client session using the STS login feature.

		Ensure you replace <url-to-remote-authenticator-endpoint> with the actual URL of your Authentication Service.


		## STS Login with high level python client


		## STS Login with high level python client

		The Python client simplifies initiating a client session with STS login. Use the following example to start a new session:

	> The architecture documentation begins at the stage following the generation of the code by the remote authenticator.
	> The architecture documentation begins at the stage after the generation of the code by the remote authenticator.

	This document outlines the process, from setting up the STS authentication flow to using temporary credentials to interact with lakeFS through the [high-level Python SDK](../../integrations/python.md).
	This document outlines the process, from enabling STS authentication to using temporary credentials to interact with lakeFS through the [high-level Python SDK](../../integrations/python.md).

Document the STS flow #7639

Document the STS flow #7639

Conversation

guy-har commented Apr 8, 2024

github-actions bot commented Apr 8, 2024

github-actions bot commented Apr 8, 2024 • edited Loading

github-actions bot commented Apr 8, 2024 • edited Loading

E2E Test Results - DynamoDB Local - Local Block Adapter

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

guy-har Apr 10, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

guy-har commented Apr 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

talSofer left a comment

Choose a reason for hiding this comment

github-actions bot commented Apr 8, 2024 •

edited

Loading

github-actions bot commented Apr 8, 2024 •

edited

Loading

guy-har Apr 10, 2024 •

edited

Loading