Enable usage of bearer tokens #341

dataclouder · 2020-11-09T21:16:27Z

The SDK now accepts both the old (deprecated) authorization token and the bearer token.
The usage is transparent: it doesn't require new options or configuration. If we enter a bearer token instead of an authorization token, it gets used.

How to test:

run ./scripts/get_token.sh
Copy the bearer token
Paste the token into the configuration file
Set the environment variable GOVCD_LOG_PASSWORDS=1
Run a quick test (such as Test_GetVcdVersion)
Check the logs, making sure that the Authorization header now contains the bearer token and that the X-Vmware-Vcloud-Token-Type header contains "Bearer".
Change the token to the authorization token (also from step 1)
Run steps 4-6 (the token used is the short one)
Remove the token from the configuration file
Run steps 4-5
Check the logs, making sure that Authorization header contains the bearer token.

This PR also adds a transparent fallback connection using cloudapi/1.0.0/sessions when the call to /api/session has been disabled. No action is needed to activate it. When the fallback call happens, we'll find trace information in the logs:

2020/11/10 15:35:16 [TRACE] Connecting to VCD using cloudapi
2020/11/10 15:35:16 [TRACE] URL https://bos1-vcloud-static-xxx-xxx.eng.vmware.com/cloudapi/1.0.0/sessions/provider

To test the fallback functionality, disable access to api/sessions following the instructions in this page and then run any test without token.

Add support for bearer token

* The default token is now a bearer token * The library accepts both authorization and bearer tokens when passed as user option

dataclouder · 2020-11-10T10:51:33Z

util/logging.go

@@ -79,7 +79,7 @@ var (
 	LogHttpResponse bool = true

 	// List of tags to be excluded from logging
-	skipTags = []string{"SupportedVersions", "ovf:License"}
+	skipTags = []string{"ovf:License"}


the SupportedVersions call in recent releases has become short and bearable, while up to 9.5 it was 600+ lines.

vbauzys

LGTM.
Maybe we already can update sample configuration and state that

    # The vCD address, in the format https://vCD_IP/api
    # or https://vCD_host_name/api
    url: https://11.111.1.111/api

should be

    url: https://11.111.1.111/openapi

dataclouder · 2020-11-10T12:05:01Z

LGTM.
Maybe we already can update sample configuration and state that

    # The vCD address, in the format https://vCD_IP/api
    # or https://vCD_host_name/api
    url: https://11.111.1.111/api

should be

    url: https://11.111.1.111/openapi

Not yet.
This may work for the initial connection, and we would get a valid token, but there are three problems:

It won't work in 9.7
the connection call is different for provider and tenant (see get_token.sh for an example)
many calls in our SDK still require the /api format.

If a VCD has disabled authentication using /api/sessions we can automatically attempt a connection using /cloudapi/1.0.0/sessions

Didainius

My testing worked out well.

Didainius · 2020-11-10T12:20:03Z

CHANGELOG.md

 * Added methods `adminVdc.UpdateStorageProfile` [#340](https://github.com/vmware/go-vcloud-director/pull/340)

 BREAKING CHANGES:

 * type.VdcConfiguration (used for creation) changed the type for storage profile from `[]*VdcStorageProfile` to `[]*VdcStorageProfileConfiguration`
+>>>>>>> master


lvirbalas · 2020-11-11T09:16:16Z

govcd/api_vcd.go

-	vcdCli.Client.VCDToken = resp.Header.Get(AuthorizationHeader)
-	vcdCli.Client.VCDAuthHeader = AuthorizationHeader
+	vcdCli.Client.VCDToken = resp.Header.Get(BearerTokenHeader)
+	vcdCli.Client.VCDAuthHeader = BearerTokenHeader


I'm a bit confused by this part. Have we removed the authorization token completely in favor of the bearer token?

No.
We have changed the token that we use to keep the client working. Previously, we injected the authorization token at connection time in the client, so that it would be used for further operations. Now we use the bearer token for the same purpose.

However, if you connect using the old authorization token, it will be used like before.

CHANGELOG.md

lvirbalas

LGTM!

Giuseppe Maxia added 3 commits November 9, 2020 21:50

Remove SupportedVersions from log filtered tags

6574e3b

Update script get_token.sh

ce2fe61

Add support for bearer token

Add support for bearer token

ed342d2

* The default token is now a bearer token * The library accepts both authorization and bearer tokens when passed as user option

vmwclabot added the cla-not-required label Nov 9, 2020

Giuseppe Maxia added 2 commits November 9, 2020 22:17

[skip ci] Update CHANGELOG.md

d9fe24d

[skip ci] Update get_token.sh to include openapi

a6930d4

dataclouder marked this pull request as ready for review November 10, 2020 08:38

dataclouder requested review from lvirbalas, vbauzys and Didainius November 10, 2020 08:38

Merge branch 'master' into bearer-token

6166a2c

dataclouder mentioned this pull request Nov 10, 2020

Add support for bearer token vmware/terraform-provider-vcd#590

Merged

dataclouder commented Nov 10, 2020

View reviewed changes

vbauzys approved these changes Nov 10, 2020

View reviewed changes

dataclouder marked this pull request as draft November 10, 2020 13:10

Giuseppe Maxia added 2 commits November 10, 2020 15:31

Add fallback connection using cloudapi

169dd3f

If a VCD has disabled authentication using /api/sessions we can automatically attempt a connection using /cloudapi/1.0.0/sessions

Update script get_token.sh to switch version

699bd00

dataclouder marked this pull request as ready for review November 10, 2020 14:40

Didainius approved these changes Nov 11, 2020

View reviewed changes

Giuseppe Maxia added 2 commits November 11, 2020 09:42

[skip ci] Fix CHANGELOG.md

91cdae7

Purge questionable terms from comments/code

ba52631

lvirbalas reviewed Nov 11, 2020

View reviewed changes

[skip ci] Update CHANGELOG.md

03c18c7

lvirbalas approved these changes Nov 11, 2020

View reviewed changes

dataclouder merged commit e4834af into vmware:master Nov 11, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable usage of bearer tokens #341

Enable usage of bearer tokens #341

dataclouder commented Nov 9, 2020 •

edited

Loading

dataclouder Nov 10, 2020

vbauzys left a comment •

edited

Loading

dataclouder commented Nov 10, 2020

Didainius left a comment

Didainius Nov 10, 2020

lvirbalas Nov 11, 2020

dataclouder Nov 11, 2020

lvirbalas left a comment

Enable usage of bearer tokens #341

Enable usage of bearer tokens #341

Conversation

dataclouder commented Nov 9, 2020 • edited Loading

dataclouder Nov 10, 2020

Choose a reason for hiding this comment

vbauzys left a comment • edited Loading

Choose a reason for hiding this comment

dataclouder commented Nov 10, 2020

Didainius left a comment

Choose a reason for hiding this comment

Didainius Nov 10, 2020

Choose a reason for hiding this comment

lvirbalas Nov 11, 2020

Choose a reason for hiding this comment

dataclouder Nov 11, 2020

Choose a reason for hiding this comment

lvirbalas left a comment

Choose a reason for hiding this comment

dataclouder commented Nov 9, 2020 •

edited

Loading

vbauzys left a comment •

edited

Loading