OCI join method - Add server auth ceremony #51446
Conversation
atburke
force-pushed
the
atburke/oci-join-2
branch
from
e353656 to
acaf9c2
Compare
atburke
force-pushed
the
atburke/oci-join-2
branch
2 times, most recently
from
6ad2308 to
21128b0
Compare
atburke
force-pushed
the
atburke/oci-join-3
branch
from
5fee41e to
90e7eac
Compare
lib/auth/join_oracle.go
Outdated
| } | ||
|
|
||
| // Check allow rules. | ||
| token, ok := provisionToken.(*types.ProvisionTokenV2) |
There was a problem hiding this comment.
What if we introduce V3? Perhaps using provisionToken.GetVersion() and asserting a minimum version here would be more future-proof?
There was a problem hiding this comment.
We'd still need to cast to v2 to get the v2 spec.
atburke
force-pushed
the
atburke/oci-join-3
branch
from
939e2e2 to
83ab4f3
Compare
| // validateOracleJoinToken validates the fields in a token using the Oracle | ||
| // join method. It's done here instead of in the client so the client doesn't | ||
| // have to import the Oracle SDK. | ||
| func validateOracleJoinToken(token types.ProvisionToken) error { |
There was a problem hiding this comment.
I think this would be more consistent with other types if this were moved within a new func ValidateProvisionToken(token types.ProvisionToken) error in services/provisioning.go. However, as indicated in your comment, that would add the Oracle SDK to more dependency trees than desired.
There was a problem hiding this comment.
I would definitely make sure we add a comment /somewhere/ that indicates that the validation for these fields exists here - I can see this being super hard to find. Probably more evidence that we need to break clients away from depending on lib/services.
atburke
force-pushed
the
atburke/oci-join-3
branch
from
d897eee to
a8c5529
Compare
atburke
force-pushed
the
atburke/oci-join-2
branch
from
d647b43 to
db0511e
Compare
atburke
force-pushed
the
atburke/oci-join-3
branch
from
f7c60aa to
40c332a
Compare
|
@atburke - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes. |
atburke
force-pushed
the
atburke/oci-join-3
branch
from
ebdc51e to
3994680
Compare
rosstimothy
requested review from
bl-nero,
strideynet,
nklaassen and
rosstimothy
public-teleport-github-review-bot
bot
removed the request for review
from ravicious
This change adds the server side of the auth ceremony for the Oracle join method.
atburke
force-pushed
the
atburke/oci-join-3
branch
from
153419a to
ef524ca
Compare
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
This change adds the server side of the auth ceremony for the Oracle join method.
This change adds the server side of the auth ceremony for the Oracle join method (RFD).
Part of #41705.
Follows #51445.
Changelog: Added Oracle cloud join method