Hi,
my actual architecture is this: picture
Therefore a single user node-red instance is started (spawned) by the jupyterhub. To secure the routes the node-red instance has to do oauth2 against the jupyterhub.
This can be done by adding a passport-oauth2 strategy in the settings file.
Unfortunately to make this work I need to fix two files.
-
@node-red/editor-api/lib/auth/index.js in function
genericStrategy
const mystrategy = new strategy.strategy(options, verify);
mystrategy.userProfile = function (accesstoken, done) {
log.audit('depp')
log.audit(accesstoken)
this._oauth2._request("GET", process.env.JUPYTERHUB_API_URL+"/user", { Authorization: "Bearer "+ accesstoken }, null, accesstoken, (err, data) => {
log.audit(data)
if (err) { return done(err); }
try {
data = JSON.parse( data );
}
catch(e) {
return done(e);
}
done(null, data);
});
};
passport.use(mystrategy);
This is an override that is specific to the jupyterhub rest api to get the user profile.
? Could this also be done in the settings.js?
- in passport-oauth2/lib/strategy.js in function
OAuth2Strategy.prototype.authenticate
I have to force that the callback url is relative and will not be resolved to the full host path. Thats solved by comment out this section
if (callbackURL) {
var parsed = url.parse(callbackURL);
if (!parsed.protocol) {
// The callback URL is relative, resolve a fully qualified URL from the
// URL of the originating request.
callbackURL = url.resolve(utils.originalURL(req, { proxy: this._trustProxy }), callbackURL);
}
}
The reason is that the callback url is checked by the oauth2 provider (= jupyterhub) and shall be accessable within the namespace in the kubernetes cluster.
See this commit here which requests for a merge in passport-oauth2 https://github.com/jaredhanson/passport-oauth2/pull/52/files
Is this of topic for node-red?
Are there any hints?
Thanks
Andreas
