fedora-infrastructure

#5982 OpenID Connect scope and secrets for Beaker
Closed Opened by dcallagh.

Closed
Reopen Issue

We would like to turn on the new OpenID token authentication which @puiterwijk implemented in Beaker for us. We are using the following scope:

https://beaker-project.org/oidc/scope

Can you please add that to the scopes on id.stg.fedoraproject.org and id.fedoraproject.org?

We will also need a client ID and client secret, for both beaker.stg.fedoraproject.org and beaker.qa.fedoraproject.org, which we can put into the Beaker server config. Can you please create these and put them into inventory and/or secrets? If you pick some sane variables names and just tell me the names, I can update the beaker role to insert them into the server config.

Sorry if there is anything in this request which is wrong/missing, as I am still new to the OpenID Connect stuff.

cc @tflink

cc @tflink

For the scope registration, please create the corresponding table at https://fedoraproject.org/wiki/Infrastructure/Authentication

Table created.

We eventually want staging and prod here too. I only requested Development so far. Is there any reason to not go ahead and request Staging and Production now?

Yeah this ticket was actually for stage and prod, because there is no dev Beaker instance in Fedora. :-)

Yeah this ticket was actually for stage and prod, because there is no dev Beaker instance in Fedora. :-)

Sorry for the duplicate comments... not sure why that keeps happening, I think it's some bug in Pagure's UI but I can't figure out what exactly.

OK - table updated to reflect the request for Staging and Production.

@puiterwijk, if you can ack this, I can do the work to set up the secrets.

Ack, thanks for doing this @ralph.

OK, the scope is live in staging: https://id.stg.fedoraproject.org/openidc/.well-known/openid-configuration

And in prod: https://id.fedoraproject.org/openidc/.well-known/openid-configuration

OK, there are now two vars defined in the secrets repo:

  • prod_beaker_oidc_client_secret
  • stg_beaker_oidc_client_secret

You also have the following three clients defined in ipsilon's configuration:

  • beaker-authorizer with client_secret="notsecret", for clients
  • beaker-stg with client_secret="${stg_beaker_oidc_client_secret}", for staging server-side.
  • beaker-prod with client_secret="${prod_beaker_oidc_client_secret}", for prod server-side.

Let me and @puiterwijk know if anything isn't working as expected.

Metadata Update from @ralph:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.