[Qt][C++] Oauth2 Authorization Code Flow and Implicit Flow Support.#10183
Merged
wing328 merged 9 commits intoOpenAPITools:masterfrom Nov 14, 2021
basyskom-dege:master
Merged
[Qt][C++] Oauth2 Authorization Code Flow and Implicit Flow Support.#10183wing328 merged 9 commits intoOpenAPITools:masterfrom basyskom-dege:master
wing328 merged 9 commits intoOpenAPITools:masterfrom
basyskom-dege:master
Conversation
5 tasks
basyskom-dege
changed the title
MartinDelille
suggested changes
Aug 29, 2021
MartinDelille
approved these changes
Oct 30, 2021
Contributor
MartinDelille
left a comment
MartinDelille
left a comment
There was a problem hiding this comment.
I'm not an expert in Oauth2 authorization management so I cannot judge but at least I can say that this PR doesn't break anything.
Contributor
Author
Im not an expert as well but maybe @etherealjoy has some more knowledge to do a review. For testing i used multiple "test" server. For the Implicit and Authorization Code Flows, i used the Google Oauth2 API. You have to create an Web-App, set the redirect url to For the client credential flow, I used tools from HERE. They also provide the other flows but you cant set the redirect url to localhost... The password flow has to be tested "manually" because it is deprecated and considered unsafe for obvious reasons. But since its in OpenAPI, I added it aswell. I used a Node.js server with router from Express package. I just added a route and logged the client_id (you can check for all parameters and see if it fits the expected values) and answered with a fixed token since its just for testing: I used the following securitySchemes in the input file: |
MartinDelille
approved these changes
Nov 2, 2021
Member
|
@basyskom-dege looks like this breaks the build: Can you please take a look when you've time? To run the tests locally, try |
Contributor
Author
|
Yes, i forgot to add the QT5Gui Package for Cmake (this is needed to open the authURL in the browser). Should be fixed now. Integration-test works on my machine. I pushed it to my Branch. Should i open a new PR? -> Commit |
Member
|
Yes please open a new PR |
5 tasks
Contributor
Author
Done -> #10921 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR will enable OAuth2 Support for the Authorization Code Flow, Implicit Flow, Password Flow and Client Credentials Flow. The oauth-class will provide a reply server based on the QTcpserver module. This is a followup PR from #8831. I took some input from @etherealjoy `s comment in the old PR.
But there are some steps unclear:
Where should we store the information for the request? We need the state, ClientId and ClientSecret etc. This Comment refers to the Specification that states we should use the tools we like to provide those variables. Do you have something in mind here? My take would be a config file in some way. By now there are dummy values and once you call the Oauth process you will get
incalid Client_idsince its just a dummy value.Another problem might be the fact that the oauth flow can only be used in a
QtGuiApplicationsince it uses theQDesktopServices::openUrl()function to open the oauth pop-up window.Any feedback or input would be highly appreciated!
EDIT: one more thing. Is there a way to test the Petstore with the Authorization flow? Right now I just use the google API and a local Node.js server that just checks if token is set and if not it will just send
QNetworkReply::AuthenticationRequiredErrorto trigger the authorization process.EDIT2: I also added the client credential flow. There is the same problem with the client_secret and id as described above.
PR checklist
This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
These must match the expectations made by your contribution.
You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example
./bin/generate-samples.sh bin/configs/java*.For Windows users, please run the script in Git BASH.
master(5.3.0),6.0.xPING @wing328 @ravinikam (2017/07) @stkrwork (2017/07) @etherealjoy (2018/02) @MartinDelille (2018/03) @muttleyxd (2019/08)