You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "Damans227 (via GitHub)" <gi...@apache.org> on 2026/10/08 14:47:03 UTC
[PR] check every keycloak login code instead of reusing the last token [cloudstack]
Damans227 opened a new pull request, #14367:
URL: https://github.com/apache/cloudstack/pull/14367
Fixes #13861
The keycloak login kept the token from the first code it checked and reused it for every later code until the management server restarted, so new codes were never checked with keycloak. This checks each code with keycloak on its own, and keeps the verified email for one minute only for that code, so the second check in the same login does not call keycloak again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "nvazquez (via GitHub)" <gi...@apache.org>.
nvazquez commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6512442669
Hi @Damans227 is this PR still in progress or ready for review?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6063758637
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19480
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "Damans227 (via GitHub)" <gi...@apache.org>.
Damans227 commented on code in PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#discussion_r4222010564
##########
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java:
##########
@@ -54,13 +58,17 @@ public class KeycloakOAuth2Provider extends AdapterBase implements UserOAuth2Aut
public static final String KEYCLOAK_PROVIDER = "keycloak";
- protected String idToken = null;
-
@Inject
OauthProviderDao oauthProviderDao;
private CloseableHttpClient httpClient;
+ private final Cache<String, String> validatedEmailCache =
+ Caffeine.newBuilder()
+ .expireAfterWrite(60, TimeUnit.SECONDS)
+ .maximumSize(1024)
+ .build();
+
Review Comment:
yes, both calls need to land on the same server. thats the same as the google login today, and the old code kept the token on one server too, so this doesnt make it worse.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6062650625
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/14367?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 3.70%. Comparing base ([`17294ca`](https://app.codecov.io/gh/apache/cloudstack/commit/17294cac7a6357b8c2c9c8183eee023920e2617a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`c0f9bec`](https://app.codecov.io/gh/apache/cloudstack/commit/c0f9bec0fdb2dacda36207253704e86ef9c41c53?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
> :exclamation: There is a different number of reports uploaded between BASE (17294ca) and HEAD (c0f9bec). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (17294ca) | HEAD (c0f9bec) |
>|------|------|------|
>|unittests|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #14367 +/- ##
=============================================
- Coverage 19.91% 3.70% -16.21%
=============================================
Files 6373 487 -5886
Lines 577234 41996 -535238
Branches 70696 7942 -62754
=============================================
- Hits 114945 1558 -113387
+ Misses 449724 40212 -409512
+ Partials 12565 226 -12339
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/14367/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/14367/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `3.70% <ø> (ø)` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/14367/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/cloudstack/pull/14367?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6528648593
Packaging result [SF]: ✖️ el8 ✖️ el9 ✔️ debian ✔️ suse15. SL-JID 19860
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "Damans227 (via GitHub)" <gi...@apache.org>.
Damans227 commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6062723107
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "Damans227 (via GitHub)" <gi...@apache.org>.
Damans227 commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6522696168
> Hi @Damans227 is this PR still in progress or ready for review?
@nvazquez ready for review. tested on a lab with a real keycloak, before and after are in the description.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6527137821
@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6062787225
@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "Pearl1594 (via GitHub)" <gi...@apache.org>.
Pearl1594 commented on code in PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#discussion_r4221607599
##########
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java:
##########
@@ -54,13 +58,17 @@ public class KeycloakOAuth2Provider extends AdapterBase implements UserOAuth2Aut
public static final String KEYCLOAK_PROVIDER = "keycloak";
- protected String idToken = null;
-
@Inject
OauthProviderDao oauthProviderDao;
private CloseableHttpClient httpClient;
+ private final Cache<String, String> validatedEmailCache =
+ Caffeine.newBuilder()
+ .expireAfterWrite(60, TimeUnit.SECONDS)
+ .maximumSize(1024)
+ .build();
+
Review Comment:
I have a question about multi-management-server setups. The UI login is two requests: verifyOAuthCodeAndGetUser exchanges the code and returns the email, then oauthlogin calls verifyUser with the same code. validatedEmailCache is an in-memory Caffeine cache, so it is local to one management server. Both requests have to land on the same MS for verifyUser to hit the cache.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "nvazquez (via GitHub) via commits" <co...@cloudstack.apache.org>.
nvazquez commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6564063411
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] check every keycloak login code instead of reusing the last token [cloudstack]
Posted by "nvazquez (via GitHub)" <gi...@apache.org>.
nvazquez commented on PR #14367:
URL: https://github.com/apache/cloudstack/pull/14367#issuecomment-6527110230
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org