freshmaker

#3 Implement openidc token based auth for contacting MBS
Closed: Invalid by lucarval. Opened by fivaldi.

Closed: Invalid
Reopen Issue

To be able to rebuild a module in MBS, CoCo needs:

  • service account on FAS.
  • get the token from the fedora ID server.
  • be able to refresh the token using the refreshing token by contacting special ID server API.

@puiterwijk has a dev instance of ID server which we could use to test this feature.

Following is part of discussion about this feature from #fedora-modularity IRC:

[09:12] <puiterwijk> jkaluza: But in short, with service account, your application has a specific username/password that can be used to get a token at the OpenID Connect server
[09:12] <jkaluza> puiterwijk: do I need to refresh that token?
[09:12] <puiterwijk> Yes. Just like the user ones.
[09:13] <puiterwijk> Every token is only valid for up to an hour ever
[09:13] <puiterwijk> (with Ipsilon)
[09:13] <jkaluza> puiterwijk: I'm thinking how that will work when we deploy that... the app probably won't open the browser
[09:13] <puiterwijk> jkaluza: correct. Which is why Service Accounts have their own API where they can request a token with a pre-approved set of scopes

Note that, @pingou advised me to request "long lived tokens" from the fedora-infra team to use for now until ipsilon has the feature we need.

Also, looking at the code, I am not entirely sure why you need to auth to MBS? The only place I found code to authenticate to MBS is for reading compose status, which should be available unauthenticated?

@puiterwijk Hi, currently, the code in mbs.py makes a request to MBS to start a build.

We don't have any immediate plans to have Freshmaker rebuilding modules in fedora. I'm dropping this issue. If we do this in the future, it'll require re-scoping changes anyways.

Metadata Update from @lucarval:
- Issue close_status updated to: Invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.