DXCDT-296: Supporting additional scopes when authenticating as user #561

willvedd · 2022-12-15T15:02:02Z

🔧 Changes

In #538 we added nearly all of the Management API scopes to enable out-the-box support for the api command. In hindsight, this over-provisioning of scopes was unnecessary and at worse a liability for some. Instead, we're only provisioning scopes for first-class CLI features during initial grant, additional scopes can be requested with the --scopes flag during auth0 login. Example:

auth0 login --scopes reade:client_grants

This flag provides a flexible means of providing feature parity through the api command while not overtly violating the principle of least privilege. Also, a nice side effect of this change is that new Management API features that come with accompanying scopes have immediate support, no need to wait for those scopes to be added to the code base.

In addition to supporting this behavior, 403 "insufficient scope" errors are detected and a crafted error message is made to guide the user to rectify using the --scopes flag. See:

📚 References

Related PRs:

🔬 Testing

📝 Checklist

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

willvedd · 2022-12-15T16:42:42Z

internal/auth/auth.go

-// Start kicks-off the device authentication flow by requesting
-// a device code from Auth0. The returned state contains the
-// URI for the next step of the flow.
-func (a *Authenticator) Start(ctx context.Context) (State, error) {


A bit of a refactor here. Removing the Start function because it only exists as a function wrapper for getDeviceCode. Further, the name wasn't descriptive of what the function did.

willvedd · 2022-12-15T16:43:36Z

internal/auth/auth.go

+// GetDeviceCode kicks-off the device authentication flow by requesting
+// a device code from Auth0. The returned state contains the
+// URI for the next step of the flow.
+func (a *Authenticator) GetDeviceCode(ctx context.Context, additionalScopes []string) (State, error) {


The only functional change here is the addition of the additionalScopes argument, which enables the passing of additional scopes when requesting a grant.

willvedd · 2022-12-15T16:44:26Z

internal/auth/auth.go

-	if err != nil {
-		return State{}, fmt.Errorf("failed to create the request: %w", err)
-	}
+		scopesToRequest := append(requiredScopes, additionalScopes...)


Change to note – combining the required scopes with additional scopes.

…auth0-cli into DXCDT-296-dynamic-scoping

Widcket · 2022-12-15T21:46:50Z

docs/auth0_login.md

@@ -27,6 +28,7 @@ auth0 login --domain <tenant-domain> --client-id <client-id> --client-secret <cl
      --client-secret string   Client secret of the application when authenticating via client credentials.
      --domain string          Tenant domain of the application when authenticating via client credentials.
  -h, --help                   help for login
+      --scopes strings         Additional scopes to request when authenticating via device code flow. By default, only scopes for first-class functions are requested. Primarily useful when using the api command to execute arbitrary Management API requests.


Any way we can support the use case mentioned in #556 (only X scopes when scripting)? Note that as we add support for more and more resources, the number of scopes requested initially will keep going up. This is probably fine for human usage, but for machine usage we'll probably want to find an alternative.

Absolutely. However, that is a separate task. This PR only pertains to scoping with respect to device code flow, whereas #556 is concerned with client credentials. I think that work is better suited for its own PR.

…auth0-cli into DXCDT-296-dynamic-scoping

internal/auth/auth.go

* DXCDT-287: Remove format flag in favor of json flag (#533) * DXCDT-288: Add perms alias for permissions subcommand (#534) * DXCDT-286: Relegate --force flag from global context (#535) * DXCDT-286: Hide global flags from commands when not applicable (#536) * [1/4] DXCDT-266: Move domains subcommand one level up the hierarchy (#539) * [2/4] DXCDT-266: Bring branding emails command under email templates (#540) * Back-merging `main` into `v1` (#543) DXCDT-293: Access token management for client credentials (#537) * Storing and refreshing access token for client credentials * Removing unnecessary comment * Removing tenant name from being stored, removing flag declarations * Removing tenant name from being stored * Fixing erroneous delete * Simplifying ExpiresAt assignment * Remove duplicate addTenant in tenants add command * Remove setting scopes on tenant when using client credentials * Refactor how we check for token expiration while preparing the tenant * Refactor cli.prepareTenant func * Refactor cli.setup func Co-authored-by: Will Vedder <will.vedder@okta.com> Co-authored-by: Sergiu Ghitea <sergiu.ghitea@okta.com> Co-authored-by: Will Vedder <will.vedder@okta.com> Co-authored-by: Sergiu Ghitea <sergiu.ghitea@okta.com> * [3/4] DXCDT-266: Rename branding cmd to universal-login (#541) * [4/4] DXCDT-266: Update docs after branding command refactor (#542) * DXCDT-283: Remove `config` command (#532) Co-authored-by: Will Vedder <will.vedder@okta.com> * DXCDT-267: Consolidate `auth0 add tenants` into `auth0 login` (1/x) (#546) Co-authored-by: Will Vedder <will.vedder@okta.com> Co-authored-by: Sergiu Ghitea <sergiu.ghitea@okta.com> * DXCDT-267: Graceful handling of access token regeneration (2/x) (#547) Co-authored-by: Rita Zerrizuela <zeta@widcket.com> Co-authored-by: Will Vedder <will.vedder@okta.com> Co-authored-by: Sergiu Ghitea <sergiu.ghitea@okta.com> * DXCDT-298: Interactive login prompt (3/x) (#551) Co-authored-by: Rita Zerrizuela <zeta@widcket.com> Co-authored-by: Will Vedder <will.vedder@okta.com> Co-authored-by: Sergiu Ghitea <28300158+sergiught@users.noreply.github.com> Co-authored-by: Sergiu Ghitea <sergiu.ghitea@okta.com> * DXCDT-295: Refactor quickstarts command to use quickstart meta URL (#553) * DXCDT-297: Remove env var ingestion (#554) Removing environment variable ingestion, removing unnecessary comment Co-authored-by: Will Vedder <will.vedder@okta.com> * DXCDT-271: Add ci step to check that docs are up to date (#560) * DXCDT-271: Move bundle install out of make docs and into docs-start (#562) * DXCDT-296: Supporting additional scopes when authenticating as user (#561) * Adding additional scopes support via --scopes flag * Adding additional scopes support via --scopes flag * Removing logging * Uncommenting scope, removing Start function * Condensing error to single line * Fixing linting errors * Changing test * Updating docs * Unpluralizing text, setting nil default value * Fixing bad help text * Tiny refactors on the login cmd * Fixing linting error * Update internal/auth/auth.go Co-authored-by: Will Vedder <will.vedder@okta.com> Co-authored-by: Rita Zerrizuela <zeta@widcket.com> Co-authored-by: Sergiu Ghitea <sergiu.ghitea@okta.com> Co-authored-by: Sergiu Ghitea <28300158+sergiught@users.noreply.github.com> * DXCDT-271: Fix generated docs (#563) * Rename build_doc to doc-gen * Downgrade json flag from persistent to local * Update doc pages * DXCDT-272 Add install script and update README (#564) Co-authored-by: Will Vedder <willvedd@gmail.com> Co-authored-by: Will Vedder <will.vedder@okta.com> * DXCDT-273: Authentication documentation (#565) Co-authored-by: Will Vedder <will.vedder@okta.com> * Updating README * Targeting main branch before we forget to change back Co-authored-by: Sergiu Ghitea <28300158+sergiught@users.noreply.github.com> Co-authored-by: Will Vedder <will.vedder@okta.com> Co-authored-by: Sergiu Ghitea <sergiu.ghitea@okta.com> Co-authored-by: Rita Zerrizuela <zeta@widcket.com>

willvedd added 5 commits December 5, 2022 14:35

Merge branch 'v1' of https://github.com/auth0/auth0-cli into v1

253f880

Merge branch 'v1' of https://github.com/auth0/auth0-cli into v1

4cea50f

Adding additional scopes support via --scopes flag

2cb6f19

Adding additional scopes support via --scopes flag

06723ec

Removing logging

73ea1c9

willvedd changed the base branch from main to v1 December 15, 2022 15:02

willvedd and others added 2 commits December 15, 2022 10:03

Uncommenting scope, removing Start function

d55fd0d

Merge branch 'v1' into DXCDT-296-dynamic-scoping

1aef346

willvedd commented Dec 15, 2022

View reviewed changes

willvedd added 2 commits December 15, 2022 11:51

Condensing error to single line

b96c834

Merge branch 'DXCDT-296-dynamic-scoping' of https://github.com/auth0/…

c3541b0

…auth0-cli into DXCDT-296-dynamic-scoping

willvedd marked this pull request as ready for review December 15, 2022 16:53

willvedd requested a review from a team as a code owner December 15, 2022 16:53

willvedd and others added 7 commits December 15, 2022 13:32

Fixing linting errors

607a197

Merge branch 'v1' into DXCDT-296-dynamic-scoping

e8df004

Changing test

7d58fa9

Merge branch 'DXCDT-296-dynamic-scoping' of https://github.com/auth0/…

cb0e08f

…auth0-cli into DXCDT-296-dynamic-scoping

Updating docs

a2f5860

Unpluralizing text, setting nil default value

9be2ed0

Fixing bad help text

d5caf06

Widcket reviewed Dec 15, 2022

View reviewed changes

willvedd requested a review from a team December 15, 2022 22:12

Widcket and others added 4 commits December 16, 2022 12:23

Merge branch 'v1' into DXCDT-296-dynamic-scoping

976f9a2

Tiny refactors on the login cmd

e23b9b2

Merge branch 'DXCDT-296-dynamic-scoping' of https://github.com/auth0/…

d823184

…auth0-cli into DXCDT-296-dynamic-scoping

Fixing linting error

03bea62

sergiught reviewed Dec 16, 2022

View reviewed changes

internal/auth/auth.go Outdated Show resolved Hide resolved

Update internal/auth/auth.go

cc62501

sergiught approved these changes Dec 16, 2022

View reviewed changes

sergiught requested a review from Widcket December 16, 2022 17:41

willvedd merged commit ef14dc8 into v1 Dec 16, 2022

willvedd deleted the DXCDT-296-dynamic-scoping branch December 16, 2022 18:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DXCDT-296: Supporting additional scopes when authenticating as user #561

DXCDT-296: Supporting additional scopes when authenticating as user #561

willvedd commented Dec 15, 2022 •

edited

Loading

willvedd Dec 15, 2022

willvedd Dec 15, 2022

willvedd Dec 15, 2022

Widcket Dec 15, 2022

willvedd Dec 15, 2022

DXCDT-296: Supporting additional scopes when authenticating as user #561

DXCDT-296: Supporting additional scopes when authenticating as user #561

Conversation

willvedd commented Dec 15, 2022 • edited Loading

🔧 Changes

📚 References

🔬 Testing

📝 Checklist

willvedd Dec 15, 2022

Choose a reason for hiding this comment

willvedd Dec 15, 2022

Choose a reason for hiding this comment

willvedd Dec 15, 2022

Choose a reason for hiding this comment

Widcket Dec 15, 2022

Choose a reason for hiding this comment

willvedd Dec 15, 2022

Choose a reason for hiding this comment

willvedd commented Dec 15, 2022 •

edited

Loading