Allow using OAuth2 for destinations

[ctron]

Problem

Using a uri or ref as a destination (e.g. in a Sequence) the receiving endpoint might be secured and require credentials to allow access.

Using uri it is currently possible to provide "username/password" credentials. However, OAuth2 is a reasonable choice for authentication as well.

KNative eventing should allow to use OAuth2 for authenticating towards a receiving service.

Not being an expert on OAuth2, I guess it would make sense to allow:

• Presenting a static Bearer token
• Allowing a "Client Credentials Flow": https://auth0.com/docs/flows/client-credentials-flow
• Allowing a "Resource Owner Password Flow": https://auth0.com/docs/flows/resource-owner-password-flow

See for other flows:

• https://auth0.com/docs/flows
• https://auth0.com/docs/authorization/which-oauth-2-0-flow-should-i-use

In general it should be possible to provide credentials (like client ID and secret) using Kubernetes Secrets, like using a SecretsKeySelector (https://pkg.go.dev/k8s.io/api/core/v1#SecretKeySelector).

Persona:

Event consumer

Exit Criteria

• Validate that the event sender can authenticate against an OAuth2 enabled endoint
• Ensure that refreshing of tokens works

Time Estimate (optional):

Additional context (optional)

[lberk]

@ctron is this related to #5046 as well?
@julz @evankanderson would you be willing to take a look at this?

[ctron]

To some degree related. The alternative to my use case in Eclipse Ditto is to use "oauth". Both ways are not supported by Knative.

However, using OAuth2 in my use case might have downsides, as the "pre-authenticated" mode might allow to identify an internal user more easily. Also it might be more efficient to have a static header, compared to an oauth2 flow.

So both use cases are valid IMHO. Having one of them supported should be good enough in our case.

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[lionelvillard]

/reopen
/remove-lifecycle stale

[knative-prow]

@lionelvillard: Reopened this issue.

In response to this:

/reopen
/remove-lifecycle stale

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[gokr]

Just showing my support! IMHO any options are better than none. Often the destination has "their own ways" so... Knative should probably be relatively flexible ;) Of course, for us the oauth2 client credential flow would be awesome.

[prakrit55]

hello there, I am interested in the project for gsoc 2023, can anyone guide me how to get started and what essentials required to know ? will be happy to be a part of the community.

[allgandalf]

Hey @evankanderson , I was going through the project ideas and this project caught my attention. I would love to contribute to this project during this summer :) I am currently going through the documentation to get an in-depth knowledge of the concepts required. Shall I continue this discussion on the slack community channel ?

[evankanderson]

Hi @RohanSasne. I believe @matzew is also looking at this based on the comment here:

https://docs.google.com/document/d/1H-x_oji8LqkCyd7tlsSyclmUe7FAmEJPgRxOU_0pkn8/edit?resourcekey=0-lzDIPJsZOP3G17QE_g1lHw&pli=1&disco=AAAAjtJiE3k

You two may want to coordinate.

[allgandalf]

Yeah absolutely, thanks for the resource though !
I will try to get more involved with the community in coming weeks :)

[pierDipi]

/assign @creydr

[PiyushRaj927]

Hi @pierDipi, will this project be under LFX Mentorship Term 02 - 2023 June - August ?

[creydr]

The basic functionality for this is included in eventing core since the 1.13 release when the authentication-oidc feature flag is set to enabled. See the docs at https://knative.dev/docs/eventing/experimental-features/sender-identity.
Eventing-Kafka-Broker will support it with the next release (1.14 - implementation done, waiting for the release).
Please try it and give us feedback.