Chapter 16. Configure OAuth for Git providers

Procedure

1. Go to the GitHub OAuth application registration page.

2. Enter the following values:

   1. Application name: <application name>
   2. Homepage URL: https://<openshift_dev_spaces_fqdn>/
   3. Authorization callback URL: https://<openshift_dev_spaces_fqdn>/api/oauth/callback
3. Click Register application.
4. Click Generate new client secret.
5. Copy and save the GitHub OAuth Client ID for use when applying the GitHub OAuth App Secret.
6. Copy and save the GitHub OAuth Client Secret for use when applying the GitHub OAuth App Secret.

Procedure

1. Prepare the Secret:

   kind: Secret
   apiVersion: v1
   metadata:
     name: github-oauth-config
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: github
       che.eclipse.org/scm-server-endpoint: <github_server_url>
       che.eclipse.org/scm-github-disable-subdomain-isolation: 'false'
   type: Opaque
   stringData:
     id: <GitHub_OAuth_Client_ID>
     secret: <GitHub_OAuth_Client_Secret>

   where:

   namespace

   The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

   che.eclipse.org/scm-server-endpoint

   This depends on the GitHub product your organization is using. When hosting repositories on GitHub.com or GitHub Enterprise Cloud, omit this line or enter the default https://github.com. When hosting repositories on GitHub Enterprise Server, enter the GitHub Enterprise Server URL.

   che.eclipse.org/scm-github-disable-subdomain-isolation

   If you are using GitHub Enterprise Server with a disabled subdomain isolation option, you must set the annotation to true. Otherwise, you can either omit the annotation or set it to false.

   id

   The GitHub OAuth Client ID.

   secret

   The GitHub OAuth Client Secret.

2. Apply the Secret:

   $ oc apply -f - <<EOF
   <Secret_prepared_in_the_previous_step>
   EOF

3. Optional: To configure OAuth 2.0 for another GitHub provider, repeat the previous steps and create a second GitHub OAuth Secret with a different name.

Procedure

1. Click your avatar and go to Edit profile Applications.
2. Enter OpenShift Dev Spaces as the Name.
3. Enter https://<openshift_dev_spaces_fqdn>/api/oauth/callback as the Redirect URI.
4. Check the Confidential and Expire access tokens checkboxes.
5. Under Scopes, check the api, write_repository, and openid checkboxes.
6. Click Save application.
7. Copy and save the GitLab Application ID for use when applying the GitLab-authorized application Secret.
8. Copy and save the GitLab Client Secret for use when applying the GitLab-authorized application Secret.

Procedure

1. Prepare the Secret:

   kind: Secret
   apiVersion: v1
   metadata:
     name: gitlab-oauth-config
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: gitlab
       che.eclipse.org/scm-server-endpoint: <gitlab_server_url>
   type: Opaque
   stringData:
     id: <GitLab_Application_ID>
     secret: <GitLab_Client_Secret>

   where:

   namespace

   The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

   che.eclipse.org/scm-server-endpoint

   The GitLab server URL. Use https://gitlab.com for the SAAS version.

   id

   The GitLab Application ID.

   secret

   The GitLab Client Secret.

2. Apply the Secret:

   $ oc apply -f - <<EOF
   <Secret_prepared_in_the_previous_step>
   EOF

3. Optional: To configure OAuth 2.0 for another GitLab provider, repeat the previous steps and create a second GitLab OAuth Secret with a different name.

Procedure

1. Go to Administration > Applications > Application links.
2. Select Create link.
3. Select External application and Incoming.
4. Enter https://<openshift_dev_spaces_fqdn>/api/oauth/callback to the Redirect URL field.
5. Select the Admin - Write checkbox in Application permissions.
6. Click Save.
7. Copy and save the Client ID for use when applying the Bitbucket application link Secret.
8. Copy and save the Client secret for use when applying the Bitbucket application link Secret.

Procedure

1. Prepare the Secret:

   kind: Secret
   apiVersion: v1
   metadata:
     name: bitbucket-oauth-config
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: bitbucket
       che.eclipse.org/scm-server-endpoint: <bitbucket_server_url>
   type: Opaque
   stringData:
     id: <Bitbucket_Client_ID>
     secret: <Bitbucket_Client_Secret>

   where:

   namespace

   The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

   che.eclipse.org/scm-server-endpoint

   The URL of the Bitbucket Server.

   id

   The Bitbucket Client ID.

   secret

   The Bitbucket Client secret.

2. Apply the Secret:

   $ oc apply -f - <<EOF
   <Secret_prepared_in_the_previous_step>
   EOF

Procedure

1. Click your avatar and go to the All workspaces page.
2. Select a workspace and click it.
3. Go to Settings OAuth consumers Add consumer.
4. Enter OpenShift Dev Spaces as the Name.
5. Enter https://<openshift_dev_spaces_fqdn>/api/oauth/callback as the Callback URL.
6. Under Permissions, check all of the Account and Repositories checkboxes, and click Save.
7. Expand the added consumer and then copy and save the Key value for use when applying the Bitbucket OAuth consumer Secret.
8. Copy and save the Secret value for use when applying the Bitbucket OAuth consumer Secret.

Procedure

1. Prepare the Secret:

   kind: Secret
   apiVersion: v1
   metadata:
     name: bitbucket-oauth-config
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: bitbucket
   type: Opaque
   stringData:
     id: <Bitbucket_Oauth_Consumer_Key>
     secret: <Bitbucket_Oauth_Consumer_Secret>

   where:

   namespace

   The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

   id

   The Bitbucket OAuth consumer Key.

   secret

   The Bitbucket OAuth consumer Secret.

2. Apply the Secret:

   $ oc apply -f - <<EOF
   <Secret_prepared_in_the_previous_step>
   EOF

Procedure

1. On a command line, run the commands to create the necessary files for the next steps and for use when applying the application link Secret:

   $ openssl genrsa -out private.pem 2048 && \
   openssl pkcs8 -topk8 -inform pem -outform pem -nocrypt -in private.pem -out privatepkcs8.pem && \
   cat privatepkcs8.pem | sed 's/-----BEGIN PRIVATE KEY-----//g' | sed 's/-----END PRIVATE KEY-----//g' | tr -d '\n' > privatepkcs8-stripped.pem && \
   openssl rsa -in private.pem -pubout > public.pub && \
   cat public.pub | sed 's/-----BEGIN PUBLIC KEY-----//g' | sed 's/-----END PUBLIC KEY-----//g' | tr -d '\n' > public-stripped.pub && \
   openssl rand -base64 24 > bitbucket-consumer-key && \
   openssl rand -base64 24 > bitbucket-shared-secret

2. Go to Administration Application Links, enter https://<openshift_dev_spaces_fqdn>/ into the URL field, and click Create new link.
3. Under The supplied Application URL has redirected once, check the Use this URL checkbox and click Continue.

4. Configure the application link with the following values:

   1. Enter OpenShift Dev Spaces as the Application Name.
   2. Select Generic Application as the Application Type.
   3. Enter OpenShift Dev Spaces as the Service Provider Name.
   4. Paste the content of the bitbucket-consumer-key file as the Consumer key.
   5. Paste the content of the bitbucket-shared-secret file as the Shared secret.
   6. Enter <bitbucket_server_url>/plugins/servlet/oauth/request-token as the Request Token URL.
   7. Enter <bitbucket_server_url>/plugins/servlet/oauth/access-token as the Access token URL.
   8. Enter <bitbucket_server_url>/plugins/servlet/oauth/authorize as the Authorize URL.
   9. Check the Create incoming link checkbox and click Continue.

5. Configure the incoming link with the following values:

   1. Paste the content of the bitbucket-consumer-key file as the Consumer Key.
   2. Enter OpenShift Dev Spaces as the Consumer name.
   3. Paste the content of the public-stripped.pub file as the Public Key and click Continue.

Procedure

1. Prepare the Secret:

   kind: Secret
   apiVersion: v1
   metadata:
     name: bitbucket-oauth-config
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/component: oauth-scm-configuration
       app.kubernetes.io/part-of: che.eclipse.org
     annotations:
       che.eclipse.org/oauth-scm-server: bitbucket
       che.eclipse.org/scm-server-endpoint: <bitbucket_server_url>
   type: Opaque
   stringData:
     private.key: <Content_of_privatepkcs8-stripped.pem>
     consumer.key: <Content_of_bitbucket-consumer-key>
     shared_secret: <Content_of_bitbucket-shared-secret>

   where:

   namespace

   The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

   che.eclipse.org/scm-server-endpoint

   The URL of the Bitbucket Server.

   private.key

   The content of the privatepkcs8-stripped.pem file.

   consumer.key

   The content of the bitbucket-consumer-key file.

   shared_secret

   The content of the bitbucket-shared-secret file.

2. Apply the Secret:

   $ oc apply -f - <<EOF
   <Secret_prepared_in_the_previous_step>
   EOF

Procedure

1. Register an application in Microsoft Entra ID. See Register an application.
2. Add the Authorization callback URL https://<openshift_dev_spaces_fqdn>/api/oauth/callback to your application. See Add a redirect URI.
3. Add a client secret to your application. See Add credentials.
4. Add the Azure DevOps vso.code_write permission to the client application. See Add permissions to access your web API.
5. Connect your Azure DevOps organization to Microsoft Entra ID. See Connect your organization to Microsoft Entra ID.

Procedure

1. Prepare the Secret:

   kind: Secret
   apiVersion: v1
   metadata:
     name: azure-devops-oauth-config
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: oauth-scm-configuration
     annotations:
       che.eclipse.org/oauth-scm-server: azure-devops
   type: Opaque
   stringData:
     tenant-id: <Microsoft_Entra_ID_Tenant_ID>
     id: <Microsoft_Entra_ID_App_ID>
     secret: <Microsoft_Entra_ID_Client_Secret>

   where:

   namespace

   The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

   tenant-id

   The Microsoft Entra ID Directory (tenant) ID.

   id

   The Microsoft Entra ID Application (client) ID.

   secret

   The Microsoft Entra ID Client Secret.

2. Apply the Secret:

   $ oc apply -f - <<EOF
   <Secret_prepared_in_the_previous_step>
   EOF

Procedure

1. Modify the CheCluster Custom Resource to enable forced token refresh:

   spec:
     components:
       cheServer:
         extraProperties:
           CHE_FORCE_REFRESH_PERSONAL_ACCESS_TOKEN: "true"