GitLab Ecosystem, 27 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OAuth flow for Jira connect experiment

Description

Follow up of https://www.youtube.com/watch?v=n7TrvSlBKbw

MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66919

A

Hey after our last pairing session, we want to try to implement the os flow for jira connect on on the back end side and uh yeah, see how far we get. We have an idea for the static callback url to implement a little basic controller that just redirects back to the um atlassian namespace, and we will. The idea was to get the namespace from the um from the jot that atlassian has and then we would then put in this date so yeah. I tried that.

A

um Write this major page, and so I created a application on my gitlab.

A

I did it on the admin area, because I think, if we do that, for example, if you do that on gitlab.com, we don't need to ask the user to create an application for themselves. We can just use this application for everyone um right and it has this static url. I call it your connect of callbacks and um yeah, so uh we'll be using this to redirect them to atlassian. So um from from this page, we go to the os flow.

A

Oauth flow will um then go to my controller and my controller will figure out the namespace and then um yeah redirect basically and contain the code that we receive from from the oauth flow um right. So one one little problem I found was um that those apps they have like a secret key um and we need to know the secret key or basically also the the app client id, but I can show that so this is my oauth flow link.

A

um Inspect this one.

A

There we go um so this part is the link right, then client id. So this is the app id and, like I said, for gitlab.com we can have a have an app we can just um yeah create in the admin area, and then we can basically hard code this app id, but for self manage instance. We need to ask the self-managed admins or users to create an app and we need to have a way to enter this client id somewhere, but yeah. We can figure this out later.

A

I guess um right redirect uri that matches the um the one I specified on the admin area and then I added the scope thing. Oh no scope is the um the scope that we want api. um This is what I added state, and um so this has the jw the job token at least partially. So the first part is the jot token um and we can decode the the jot and then find the name space. But what we can't find is the um is the path to to this page.

A

Well, we can so we can have this part from the jot, but we can't have this part from the judge.

A

In theory, we can guess it, but I thought it's safer to to append it here. So basically, I just put the whole current url in there and then we can carry it on to the controller anyway. Let's try it out.

A

So let's go here right. This goes to this page. I can authorize it and.

A

I hope we can catch this in network, so authorize.

A

And, as you can see, I'm back on jira- and this is the code that we got from from the oauth flow just to prove- uh let's see if we can find it here right. This is the authorized page. This is um the controller I wrote of callbacks, and this would um then figure out the right namespace and redirect me back and also it appends the the code to the url um all right using this code. We can basically, then fetch a token from gitlab.

A

We need the code and we also need the app secret and I guess the thicket can be hard coded somewhere too um and yeah. I guess for self-managed instances. We also need a way to add this. Maybe we can build some automatic setup uh yeah, but, like I said we can figure this out later: cool yeah. That's it thanks for watching.