Begin forwarded message:
From: Alex <[email protected]<mailto:[email protected]>> Subject: Notes for Custos SDK in Galaxy Date: October 15, 2019 at 4:27:26 PM EDT To: [email protected]<mailto:[email protected]> Hey all, Some notes from the implementation of an authnz backend for Galaxy using the new SDK: General library notes: - It was a pretty painless process to switch from the already-implemented OIDC backend in Galaxy to use this SDK instead, given that a lot of calls were similar if not identical and the library is overall very well structured and easy to use, with pretty good documentation so thank you very much for that :) - Importing the library is not properly importing all the submodules. A quick fix was to change `packages=find_packages()` in the `setup.py` file to have automatic parsing of the library. - Catching all exceptions and returning `None` made debugging pretty hard (I actually re-raised the exceptions to be able to easily debug). Not sure if this was done for security concerns (eg: the exception message having sensitive information), but it does not seem ideal to blindly catch any exception. - It would be ideal to have the ability to have `nonce` verification. The easiest way to implement is likely to just allow for `extra_params` in the methods that call `oauth2_session.authorization_url` . For reference if it's helpful: https://github.com/galaxyproject/galaxy/blob/dev/lib/galaxy/authnz/custos_authnz.py#L51 Notes relating to Galaxy specifically: - There are some library version conflicts. Namely, `pluggy-0.12.0, six-1.11.0, pytest-4.6.5` are in Galaxy vs. `pluggy-0.9.0, pytest-4.3.0, six-1.12.0` in the SDK. The six package being the biggest conflict due to: ERROR: pulsar-galaxy-lib 0.14.0.dev1 has requirement six==1.11.0, but you'll have six 1.12.0 which is incompatible. ERROR: isa-rwval 0.10.7 has requirement six==1.11.0, but you'll have six 1.12.0 which is incompatible. - `scope` is hardcoded in `oauth` calls in the SDK to be `openid`, but Galaxy needs scope to be `('openid', 'email', 'profile')`. The likely solution is probably to parametrize the scope so that the SDK user can specify it. - Galaxy has a generic format for configs for all OIDC clients, which would be ideal to be able to use for the SDK as well. They are currently XML, but we thought it'd be good to converge on YAML if everyone is okay with that. It'd also be ideal to not explicitly list all endpoint URLs for Keycloak, but rather just list the Base Keycloak URL and the realm and construct the endpoint URLs from those (unless there is a technical reason not to do so). This commit on my fork reflects quick patches (minus config) regarding all these changes that were done in order to get the Galaxy backend working with this SDK, if it's helpful for reference, but I can also work in the next few weeks on implementing actual solutions for some of these things and PR them back as well: https://github.com/almahmoud/airavata-custos/commit/1139b0871fc00ae39111656fa5bf0c0c1d6313e0#diff-f823570f2ca5d272963d4847c8bec965L14 Feel free to reach out if anything is unclear, I tried to be as concise yet detailed as possible. Thanks, Alex
