Support OAuth flow for GitHub Enterprise Server

[vinokurig]

Is your task related to a problem? Please describe

Currently OAuth flow is supported for GitHub SAAS (github.com and GitHub Enterpise Cloud). We need to add the support for the on-premises version (GitHub Enterprises Server).

Describe the solution you'd like

Add a new or modify the existing GitHub OAuth handler.

Release Notes Text

Administrators can now configure Che instances to automatically connect to GitHub Enteprise Server to retrieve and configure users personal access tokens. Note the GitHub Enterprise Cloud was already supported.

[vinokurig]

Didn't mangae to start github enterprise instance localy. Need a remote instance: https://enterprise.github.com/releases/3.5.1/download

[svor]

Didn't mangae to start github enterprise instance localy. Need a remote instance: https://enterprise.github.com/releases/3.5.1/download

@l0rd could you please help with this

[vinokurig]

OAuth flow for GitHub hosted version of GitHub enterprise works without any changes. To work on the server version need an instance with the application.

[l0rd]

We discussed that today with @benoitf and @ibuziuk. On prem GitHub instances have URLs that don't match this regexp (the URL is typically something like https://github.redhat.com). To address that we should allow to specify the annotation che.eclipse.org/scm-server-endpoint for GitHub as well.

And yes, the problem about how to test it isn't solved.

[l0rd]

Using a Git Provider Access Token may be a workaround.

[vinokurig]

@l0rd

Using a Git Provider Access Token may be a workaround.

I don't think so. We would still need an endpoint to test the feature.

[l0rd]

I don't think so. We would still need an endpoint to test the feature.

@vinokurig but with the PAT secret a user can specifies the che.eclipse.org/scm-url, why do you think that's not going to work?

[vinokurig]

@l0rd You are right that Git Provider Access Token can be a workaround for a user, but not for us to work on this issue.

[ibuziuk]

@vinokurig added this issue to the next sprint as a highly important case to resolve. Just wondering if you have tried - https://docs.github.com/en/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-cloud ? (it has 30 days trial )

[benoitf]

and https://docs.github.com/en/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server is 45 days trial as well

[vinokurig]

@ibuziuk

@vinokurig added this issue to the next sprint as a highly important case to resolve. Just wondering if you have tried - https://docs.github.com/en/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-cloud ? (it has 30 days trial )

The link refers to a cloud version of GitHub enterprise whis is already supported by Che. The issue is to support the server version of GitHub enterprise.

[vinokurig]

@benoitf

and https://docs.github.com/en/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server is 45 days trial as well

Yes but it requires a spcific environment to setup: https://docs.github.com/en/enterprise-server@3.6/admin/overview/about-github-enterprise-server#supported-environments-for-deployment

[benoitf]

@vinokurig you can get credits on Azure as well (trial) to deploy it
https://azure.microsoft.com/en-us/free/

[vinokurig]

@benoitf

@vinokurig you can get credits on Azure as well (trial) to deploy it
https://azure.microsoft.com/en-us/free/

The free subscription is too weak for the github-server application:

[benoitf]

I think you need to use the $ credits, not the free instance

https://docs.gitlab.com/ee/install/azure/ (I know it's gitlab but it shows you how to use free credits $ to setup the machines on azure, gcp or amazon)

[vinokurig]

Managed to launch an instance in a local virtualbox machine

[RickJWagner]

Additional information from users:

OpenShift DevSpaces v3.1.0 is not able to pull repos from GitHub Enterprise private repos even after defining the needed secrets as called in the docs at https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.1/html/user_guide/using-credentials-and-configurations-in-workspaces.

You can find the all the our manifests (reference to support case).

What is the business impact? Please also provide timeframe information.
We use GitHub Enterprise (GHE) as our SCM solution. DevSpaces not supporting GHE severly imparis our ability to use OpenShift DevSpace.

Where are you experiencing the behavior? What environment?
OpenShift : 4.11.1
DevSpaces: 1.3.1

[spuranam]

@RickJWagner It does not looks like using GHE PAT workaroud described above does not either ... please find the details around our usecase @ https://gist.github.com/spuranam/f47d985ada94a7c0c1ee1c8553579119

[spuranam]

@RickJWagner here is more info about my test setup:

OpenShift: v4.11.1
DevSpace: v3.1.0
GitHub Enterpirse: v3.5.3

[vinokurig]

@l0rd @RickJWagner @spuranam The PR has been opened, see the link above. Please note that this just extends the current GitHub provider. It means that if the provider is configured to an Enterprise Server endpoint, the Cloud support won't be available, and vice versa.
So do we need a separate OAuth provider to support both versions at the same time?

[vinokurig]

@l0rd

@RickJWagner It does not looks like using GHE PAT workaroud described above does not either ... please find the details around our usecase @ https://gist.github.com/spuranam/f47d985ada94a7c0c1ee1c8553579119

I confirm that the manual PAT flow doesn't work for GitHub Enterprise server case, even with my PR. Do we need to support it?

[l0rd]

t means that if the provider is configured to an Enterprise Server endpoint, the Cloud support won't be available, and vice versa. So do we need a separate OAuth provider to support both versions at the same time?

Supporting only either GitHub enterprise server or github.com (but not both at the same time) is an acceptable compromise.

I confirm that the manual PAT flow doesn't work for GitHub Enterprise server case, even with my PR. Do we need to support it?

We don't need to support it right now.

[devstudio-release]

sync'd to Red Hat JIRA https://issues.redhat.com/browse/CRW-3352

[nickboldt]

Backported to 7.52 / 3.2 in eclipse-che/che-server@b35291d