{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/4279","labels_url":"https://api.github.com/repos/openshift/origin/issues/4279/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/4279/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/4279/events","html_url":"https://github.com/openshift/origin/pull/4279","id":101976885,"number":4279,"title":"Allow RequestHeaderIdentityProvider to redirect to UI login or challenging URL","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"fabianofranz","id":158611,"avatar_url":"https://avatars.githubusercontent.com/u/158611?v=3","gravatar_id":"","url":"https://api.github.com/users/fabianofranz","html_url":"https://github.com/fabianofranz","followers_url":"https://api.github.com/users/fabianofranz/followers","following_url":"https://api.github.com/users/fabianofranz/following{/other_user}","gists_url":"https://api.github.com/users/fabianofranz/gists{/gist_id}","starred_url":"https://api.github.com/users/fabianofranz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabianofranz/subscriptions","organizations_url":"https://api.github.com/users/fabianofranz/orgs","repos_url":"https://api.github.com/users/fabianofranz/repos","events_url":"https://api.github.com/users/fabianofranz/events{/privacy}","received_events_url":"https://api.github.com/users/fabianofranz/received_events","type":"User","site_admin":false},"milestone":null,"comments":14,"created_at":"2015-08-19T19:18:59Z","updated_at":"2015-09-01T16:48:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/4279","html_url":"https://github.com/openshift/origin/pull/4279","diff_url":"https://github.com/openshift/origin/pull/4279.diff","patch_url":"https://github.com/openshift/origin/pull/4279.patch"},"body":"Lets RequestHeaderIdentityProvider handle unauthenticated /authorize requests by redirecting. This allows an auth proxy to be selectively placed in front of the /oauth/authorize endpoint.\r\n\r\n- [x] Update CLI login flow to follow redirects that don't include an access token or error param\r\n- [x] Integration tests for redirect flow\r\n- [x] Unit tests for union challenger handling of conflicting redirect/challenge responses\r\n- [x] Unit tests for basic auth recognizer, realm parser\r\n- [x] update eclipse client to handle redirects: https://github.com/openshift/openshift-restclient-java/pull/63\r\n- [x] doc issue for loginURL, challengeURL - https://github.com/openshift/openshift-docs/pull/933\r\n- [x] ansible issue for auth template - https://github.com/openshift/openshift-ansible/issues/542\r\n\r\nPossible responses from `/oauth/authorize` when requesting the implicit token flow (`response_type=token`) as an OAuth client that has requested challenge authentication (like `openshift-challenging-client`):\r\n\r\nStatus | Content | Client response\r\n--------------- | ---------- | --------------------\r\n302 | `Location` header containing an `access_token` parameter in the URL fragment ([RFC 4.2.2](https://tools.ietf.org/html/rfc6749#section-4.2.2)) | Use the `access_token` value as the OAuth token\r\n302 | `Location` header containing an `error` query parameter ([RFC 4.1.2.1](https://tools.ietf.org/html/rfc6749#section-4.1.2.1)) | Fail, optionally surfacing the `error` (and optional `error_description`) query value to the user\r\n302 | Other `Location` header | Request the redirected URL, and process the result using these rules\r\n401 | `WWW-Authenticate` header present | Respond to challenge if type is recognized (e.g. `Basic`, `Negotiate`, etc), resubmit request, and process the result using these rules\r\n401 | `WWW-Authenticate` header missing | No challenge authentication is possible. Fail and show response body (which might contain links or details on alternate methods to obtain an OAuth token)\r\nOther | Other | Fail, optionally surfacing response body to the user\r\n\r\n\r\nExample config:\r\n```\r\n  identityProviders:\r\n  - challenge: true\r\n    login: true\r\n    name: authproxyprovider\r\n    provider:\r\n      apiVersion: v1\r\n      challengeURL: \"http://myproxy:1234/oauth/authorize?${query}\"\r\n      loginURL: \"http://myproxy:1234/oauth/authorize?${query}\"\r\n      kind: RequestHeaderIdentityProvider\r\n      headers:\r\n      - Remote-User\r\n```\r\n\r\nDocumentation for new fields:\r\n```\r\n\t// LoginURL is a URL to redirect unauthenticated /authorize requests to\r\n\t// ${url} is replaced with the current URL, escaped to be safe in a query parameter\r\n\t//   https://www.example.com/sso-login?then=${url}\r\n\t// ${query} is replaced with the current query string\r\n\t//   https://www.example.com/auth-proxy/oauth/authorize?${query}\r\n\tLoginURL string `json:\"loginURL\"`\r\n\r\n\t// ChallengeURL is a URL to redirect unauthenticated /authorize requests to\r\n\t// ${url} is replaced with the current URL, escaped to be safe in a query parameter\r\n\t//   https://www.example.com/sso-login?then=${url}\r\n\t// ${query} is replaced with the current query string\r\n\t//   https://www.example.com/auth-proxy/oauth/authorize?${query}\r\n\tChallengeURL string `json:\"challengeURL\"`\r\n```\r\n\r\nSample auth proxy for testing: https://gist.github.com/liggitt/3faccd9d95291a85b4ba"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/136790410","html_url":"https://github.com/openshift/origin/pull/4279#issuecomment-136790410","issue_url":"https://api.github.com/repos/openshift/origin/issues/4279","id":136790410,"user":{"login":"openshift-bot","id":1779249,"avatar_url":"https://avatars.githubusercontent.com/u/1779249?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift-bot","html_url":"https://github.com/openshift-bot","followers_url":"https://api.github.com/users/openshift-bot/followers","following_url":"https://api.github.com/users/openshift-bot/following{/other_user}","gists_url":"https://api.github.com/users/openshift-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift-bot/subscriptions","organizations_url":"https://api.github.com/users/openshift-bot/orgs","repos_url":"https://api.github.com/users/openshift-bot/repos","events_url":"https://api.github.com/users/openshift-bot/events{/privacy}","received_events_url":"https://api.github.com/users/openshift-bot/received_events","type":"User","site_admin":false},"created_at":"2015-09-01T16:48:59Z","updated_at":"2015-09-01T16:48:59Z","body":"Evaluated for origin test up to 1c99e5783a91dcf3e09af663a9f1b34d0134537d"}}