[Feature][Login] Add OAuth login #8706

Abingcbc · 2022-03-05T06:24:55Z

Purpose of the pull request

Add SSO login for Dolphinscheduler

This pull request will close
#4531
#3451

Usage

Start a Casdoor server
Configure your Casdoor in application.yaml

security:
  authentication:
    type: CASDOOR_SSO

casdoor:
  endpoint: http://localhost:8000
  client-id: 
  client-secret: 
  certificate: 
  organization-name: built-in
  application-name: app-built-in
  redirect-url: http://localhost:8888/view/login/index.html

You can find client id and client secret in Casdoor's application page and jwt public key in Casdoor's cert page.
3. Add your redirect URL http://localhost:8888/view/login/index.html in Casdoor's application setting.
4. Now start your DolphinScheduler and you can login by SSO in the way like the following video.

Brief change log

Old UI

Login.-.DolphinScheduler.-.Google.Chrome.2022-03-05.14-40-12.mp4

New UI

Screen.Recording.2022-04-10.at.22.55.34.mov

Verify this pull request

This change added tests and can be verified as follows:

Added CasdoorAuthenticator test

hsluoyz · 2022-03-07T09:39:58Z

Hi @William-GuoWei @dailidong @break60 , I am Yang Luo from Casdoor team. Casdoor is a powerful open-source single-sign-on (SSO) platform. It has the following features:

Support OIDC, OAuth 2.0, SAML, LDAP
With Casbin based authorization management, Casdoor supports ACL, RBAC, ABAC, RESTful accessing control models
Front-end and back-end separate architecture, Casdoor supports high concurrency, provides web-based managing UI and have mature solution for springboot project https://casdoor.org/docs/integration/spring-boot
Casdoor supports Github, Google, QQ, WeChat third-party applications login, and support the extension of third-party login with plugins.
Phone verification code, email verification code and forget password features.
Accessing logs auditing and recording.
Casdoor supports integration with existing systems using db sync method, users can transition to Casdoor smoothly.
Casdoor supports mainstream databases: MySQL, PostgreSQL, SQL Server etc, and support the extension of new database with plugins.

There have been a lot of user requests about the SSO scenario. This integration proposal will greatly enhance the SSO feature of DolphinScheduler with better authentication and security protection. What do you think?

dolphinscheduler-api/pom.xml

ruanwenjun

Just some comments about the naming. Maybe use Casdoor might be better rather than sso.

...scheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/AuthenticationType.java

dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/SecurityConfig.java

...pi/src/main/java/org/apache/dolphinscheduler/api/security/impl/sso/CasdoorAuthenticator.java

Abingcbc · 2022-03-10T15:49:50Z

@CalvinKirs @ruanwenjun I have fixed the CI error. Please approve to rerun :) Thanks❤️

codecov-commenter · 2022-03-11T13:43:03Z

Codecov Report

Merging #8706 (59e3a28) into dev (4545093) will increase coverage by 0.01%.
The diff coverage is 68.42%.

❗ Current head 59e3a28 differs from pull request most recent head dd1586b. Consider uploading reports for the commit dd1586b to get more accurate results

@@             Coverage Diff              @@
##                dev    #8706      +/-   ##
============================================
+ Coverage     38.20%   38.22%   +0.01%     
- Complexity     4436     4448      +12     
============================================
  Files          1220     1222       +2     
  Lines         42698    42733      +35     
  Branches       4734     4736       +2     
============================================
+ Hits          16314    16333      +19     
- Misses        24581    24593      +12     
- Partials       1803     1807       +4

Impacted Files	Coverage Δ
...nscheduler/api/configuration/AppConfiguration.java	`93.93% <ø> (ø)`
...lphinscheduler/api/controller/LoginController.java	`51.72% <0.00%> (-16.46%)`	⬇️
...inscheduler/api/service/impl/UsersServiceImpl.java	`70.78% <ø> (ø)`
...e/dolphinscheduler/common/constants/Constants.java	`75.00% <ø> (ø)`
...er/api/security/impl/sso/CasdoorAuthenticator.java	`72.22% <72.22%> (ø)`
.../org/apache/dolphinscheduler/api/enums/Status.java	`100.00% <100.00%> (ø)`
...phinscheduler/api/security/AuthenticationType.java	`100.00% <100.00%> (ø)`
.../dolphinscheduler/api/security/SecurityConfig.java	`72.72% <100.00%> (+2.72%)`	⬆️
...duler/api/security/impl/AbstractAuthenticator.java	`100.00% <100.00%> (ø)`
...er/api/security/impl/AbstractSsoAuthenticator.java	`100.00% <100.00%> (ø)`

... and 2 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

tools/dependencies/known-dependencies.txt

sonarcloud · 2022-03-16T04:19:10Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
1 Code Smell

70.8% Coverage
0.0% Duplication

ruanwenjun · 2022-03-16T09:03:01Z

@Abingcbc Thanks, right now we put the front-end code in dolphinscheduler-ui-next, and we will not maintain the dolphinscheduler-ui, could you please put your change in dolphinscheduler-ui-next.
And you may also need to add the document about this new feature in dolphinscheduler-website.

Abingcbc · 2022-04-10T15:20:26Z

@ruanwenjun I have implemented the front-end in dolphinscheduler-ui-next :) PTAL
BTW, should I keep the implementation in the old UI code? Thanks!

sonarcloud · 2022-04-26T06:49:12Z

SonarCloud Quality Gate failed.

1 Bug
0 Vulnerabilities
1 Security Hotspot
61 Code Smells

30.7% Coverage
6.6% Duplication

hsluoyz · 2022-08-22T02:02:24Z

Hi @ruanwenjun any update on this PR?

caishunfeng · 2022-11-07T01:49:21Z

Hi @Abingcbc it's a good feature, can you resolve the conflicts?
BTW, the old UI was removed in dev branch, just update the dolphinscheduler-ui (new UI) is OK.

Abingcbc · 2022-11-07T17:34:03Z

@caishunfeng I have solved the conflicts and updated the code. Furthermore, Casdoor is developing rapidly. There are a lot of new features since the last commit. So I add some codes to use a random OAuth state to prevent a CRSF attack.
Would you like to review these codes? They are mainly in dolphinscheduler-api. THX :)

caishunfeng · 2022-11-08T00:50:42Z

@caishunfeng I have solved the conflicts and updated the code. Furthermore, Casdoor is developing rapidly. There are a lot of new features since the last commit. So I add some codes to use a random OAuth state to prevent a CRSF attack. Would you like to review these codes? They are mainly in dolphinscheduler-api. THX :)

Sure, I will review it.

EricGao888 · 2022-11-08T06:50:26Z

@Abingcbc License check failed, could u plz fix it?

EricGao888 · 2022-11-08T06:51:39Z

...nscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/LoginController.java

-import static org.apache.dolphinscheduler.api.enums.Status.IP_IS_EMPTY;
-import static org.apache.dolphinscheduler.api.enums.Status.SIGN_OUT_ERROR;
-import static org.apache.dolphinscheduler.api.enums.Status.USER_LOGIN_FAILURE;
+import static org.apache.dolphinscheduler.api.enums.Status.*;


Please avoid wildcard imports, CI blocks this line.

EricGao888 · 2022-11-08T07:02:23Z

@caishunfeng I have solved the conflicts and updated the code. Furthermore, Casdoor is developing rapidly. There are a lot of new features since the last commit. So I add some codes to use a random OAuth state to prevent a CRSF attack. Would you like to review these codes? They are mainly in dolphinscheduler-api. THX :)

@Abingcbc Thanks for submitting this PR. This is an important feature, as we are also working on supporting other OAuth2 providers such as Google and GitHub #12549. I will help review this PR too.

EricGao888 · 2022-11-08T07:10:04Z

Hi @William-GuoWei @dailidong @break60 , I am Yang Luo from Casdoor team. Casdoor is a powerful open-source single-sign-on (SSO) platform. It has the following features:

Support OIDC, OAuth 2.0, SAML, LDAP

With Casbin based authorization management, Casdoor supports ACL, RBAC, ABAC, RESTful accessing control models

Front-end and back-end separate architecture, Casdoor supports high concurrency, provides web-based managing UI and have mature solution for springboot project https://casdoor.org/docs/integration/spring-boot

Casdoor supports Github, Google, QQ, WeChat third-party applications login, and support the extension of third-party login with plugins.

Phone verification code, email verification code and forget password features.

Accessing logs auditing and recording.

Casdoor supports integration with existing systems using db sync method, users can transition to Casdoor smoothly.

Casdoor supports mainstream databases: MySQL, PostgreSQL, SQL Server etc, and support the extension of new database with plugins.

There have been a lot of user requests about the SSO scenario. This integration proposal will greatly enhance the SSO feature of DolphinScheduler with better authentication and security protection. What do you think?

@hsluoyz Thanks for providing the detailed information and letting us know this fantastic tool. We will keep following up with the review and make sure it could get merged ASAP : )

hsluoyz · 2023-01-11T08:11:41Z

@caishunfeng plz approve

EricGao888 · 2023-01-11T08:15:14Z

@caishunfeng plz approve

@hsluoyz Done, have approved and restarted the CI : )

kezhenxu94 · 2023-01-11T09:42:52Z

dolphinscheduler-standalone-server/src/main/resources/application.yaml

-    # Authentication types (supported types: PASSWORD,LDAP)
-    type: PASSWORD
+    # Authentication types (supported types: PASSWORD,LDAP,CASDOOR_SSO)
+    type: CASDOOR_SSO


You can modify this in local tests, but have to revert to PASSWORD when the PR is finalized before merging

Yes, I will modify it back. THX!
The current version is just a draft for @EricGao888 to review.

Abingcbc · 2023-01-13T14:31:22Z

When I was trying to replace the configuration with Spring Security, it seems that the frontend block the second redirect because of CORS. May anyone have ideas about how to fix it? TAT

hsluoyz · 2023-01-18T12:04:49Z

@caishunfeng @EricGao888 any comments?

Abingcbc · 2023-02-06T14:56:24Z

@caishunfeng @EricGao888 @kezhenxu94 The migration to Spring Security brings significant changes to the existing login process. Besides SSO and OAuth (there are still problems with front-end redirects), the unified configuration and implementation of PASSWORD and LDAP also need to be considered.
Perhaps it's better to complete this migration work in a new PR. Therefore, I have reverted this PR and continued to use the existing configuration and method to implement the SSO function.
May you approve the CI? THX

EricGao888 · 2023-02-08T11:48:51Z

@caishunfeng @EricGao888 @kezhenxu94 The migration to Spring Security brings significant changes to the existing login process. Besides SSO and OAuth (there are still problems with front-end redirects), the unified configuration and implementation of PASSWORD and LDAP also need to be considered. Perhaps it's better to complete this migration work in a new PR. Therefore, I have reverted this PR and continued to use the existing configuration and method to implement the SSO function. May you approve the CI? THX

CI approved.

sonarcloud · 2023-02-09T04:51:13Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
3 Code Smells

68.6% Coverage
0.0% Duplication

caishunfeng · 2023-02-09T05:24:17Z

I rerun the CI.

jobmission · 2023-04-04T13:35:11Z

Great , need this feature!

EricGao888

@Abingcbc LGTM, however, u still need to resolve the conflicts and add related docs in both Chinese and English.

sonarcloud · 2023-04-26T05:36:06Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
3 Code Smells

68.6% Coverage
0.0% Duplication

Abingcbc · 2023-04-26T13:05:03Z

@caishunfeng PTAL thx :)

zhongjiajie · 2023-05-05T06:37:11Z

dolphinscheduler-ui/pnpm-lock.yaml

-  vue: 3.2.39
-  vue-i18n: 9.2.2_vue@3.2.39
-  vue-router: 4.1.5_vue@3.2.39
+  '@antv/layout':


I find this PR update many pnpm lock version, @devosend can you check whether it have to change or not?

Lock files can be changed.

devosend

LGTM for frontend

fix

CalvinKirs reviewed Mar 7, 2022

View reviewed changes

dolphinscheduler-api/pom.xml Outdated Show resolved Hide resolved

ruanwenjun reviewed Mar 8, 2022

View reviewed changes

ruanwenjun previously requested changes Mar 13, 2022

View reviewed changes

tools/dependencies/known-dependencies.txt Outdated Show resolved Hide resolved

caishunfeng added the feature new feature label Nov 7, 2022

caishunfeng assigned Abingcbc Nov 7, 2022

Abingcbc requested review from kezhenxu94, songjianet, Amy0104, caishunfeng and SbloodyS as code owners November 7, 2022 17:27

github-actions bot added backend UI ui and front end related labels Nov 7, 2022

caishunfeng added this to the 3.2.0 milestone Nov 8, 2022

caishunfeng requested review from ruanwenjun and EricGao888 November 8, 2022 00:47

EricGao888 reviewed Nov 8, 2022

View reviewed changes

kezhenxu94 reviewed Jan 11, 2023

View reviewed changes

Abingcbc marked this pull request as draft January 11, 2023 11:36

github-actions bot added the UI ui and front end related label Feb 6, 2023

Abingcbc marked this pull request as ready for review February 6, 2023 14:48

EricGao888 previously approved these changes Apr 18, 2023

View reviewed changes

Abingcbc dismissed EricGao888’s stale review via 3e2f17a April 20, 2023 14:04

Abingcbc requested a review from zhongjiajie as a code owner April 20, 2023 14:04

github-actions bot added the document label Apr 20, 2023

[Feature][Login] Add SSO login by Casdoor

dd1586b

EricGao888 approved these changes Apr 26, 2023

View reviewed changes

zhongjiajie reviewed May 5, 2023

View reviewed changes

devosend approved these changes May 5, 2023

View reviewed changes

zhongjiajie merged commit 77e58ce into apache:dev May 5, 2023

This was referenced May 5, 2023

[Feature][API] Support SSO: Single Sign On #4531

Closed

[Feature][api] Integration with existing platforms(SSO) #3451

Closed

[Feature][Authenticator] Support OAuth as an authenticator #11242

Closed

hsluoyz mentioned this pull request May 5, 2023

Add docs for Apache DolphinScheduler's SSO with Casdoor casdoor/casdoor-website#471

Closed

EricGao888 mentioned this pull request Aug 15, 2023

[Feature][Authentication] support oauth2 login #14743

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Feature][Login] Add OAuth login #8706

[Feature][Login] Add OAuth login #8706

Abingcbc commented Mar 5, 2022 •

edited

Loading

hsluoyz commented Mar 7, 2022

ruanwenjun left a comment

Abingcbc commented Mar 10, 2022

codecov-commenter commented Mar 11, 2022 •

edited

Loading

sonarcloud bot commented Mar 16, 2022

ruanwenjun commented Mar 16, 2022

Abingcbc commented Apr 10, 2022

sonarcloud bot commented Apr 26, 2022

hsluoyz commented Aug 22, 2022

caishunfeng commented Nov 7, 2022 •

edited

Loading

Abingcbc commented Nov 7, 2022

caishunfeng commented Nov 8, 2022

EricGao888 commented Nov 8, 2022

EricGao888 Nov 8, 2022

EricGao888 commented Nov 8, 2022

EricGao888 commented Nov 8, 2022

hsluoyz commented Jan 11, 2023

EricGao888 commented Jan 11, 2023

kezhenxu94 Jan 11, 2023

Abingcbc Jan 11, 2023

Abingcbc commented Jan 13, 2023 •

edited

Loading

hsluoyz commented Jan 18, 2023

Abingcbc commented Feb 6, 2023 •

edited

Loading

EricGao888 commented Feb 8, 2023

sonarcloud bot commented Feb 9, 2023

caishunfeng commented Feb 9, 2023

jobmission commented Apr 4, 2023

EricGao888 left a comment

sonarcloud bot commented Apr 26, 2023

Abingcbc commented Apr 26, 2023

zhongjiajie May 5, 2023

devosend May 5, 2023

devosend left a comment

[Feature][Login] Add OAuth login #8706

[Feature][Login] Add OAuth login #8706

Conversation

Abingcbc commented Mar 5, 2022 • edited Loading

Purpose of the pull request

Usage

Brief change log

Old UI

New UI

Verify this pull request

hsluoyz commented Mar 7, 2022

ruanwenjun left a comment

Choose a reason for hiding this comment

Abingcbc commented Mar 10, 2022

codecov-commenter commented Mar 11, 2022 • edited Loading

Codecov Report

sonarcloud bot commented Mar 16, 2022

ruanwenjun commented Mar 16, 2022

Abingcbc commented Apr 10, 2022

sonarcloud bot commented Apr 26, 2022

hsluoyz commented Aug 22, 2022

caishunfeng commented Nov 7, 2022 • edited Loading

Abingcbc commented Nov 7, 2022

caishunfeng commented Nov 8, 2022

EricGao888 commented Nov 8, 2022

EricGao888 Nov 8, 2022

Choose a reason for hiding this comment

EricGao888 commented Nov 8, 2022

EricGao888 commented Nov 8, 2022

hsluoyz commented Jan 11, 2023

EricGao888 commented Jan 11, 2023

kezhenxu94 Jan 11, 2023

Choose a reason for hiding this comment

Abingcbc Jan 11, 2023

Choose a reason for hiding this comment

Abingcbc commented Jan 13, 2023 • edited Loading

hsluoyz commented Jan 18, 2023

Abingcbc commented Feb 6, 2023 • edited Loading

EricGao888 commented Feb 8, 2023

sonarcloud bot commented Feb 9, 2023

caishunfeng commented Feb 9, 2023

jobmission commented Apr 4, 2023

EricGao888 left a comment

Choose a reason for hiding this comment

sonarcloud bot commented Apr 26, 2023

Abingcbc commented Apr 26, 2023

zhongjiajie May 5, 2023

Choose a reason for hiding this comment

devosend May 5, 2023

Choose a reason for hiding this comment

devosend left a comment

Choose a reason for hiding this comment

Abingcbc commented Mar 5, 2022 •

edited

Loading

codecov-commenter commented Mar 11, 2022 •

edited

Loading

caishunfeng commented Nov 7, 2022 •

edited

Loading

Abingcbc commented Jan 13, 2023 •

edited

Loading

Abingcbc commented Feb 6, 2023 •

edited

Loading