Overview
OAuth2 is the permission delegation protocol ubiquitous in the web world. Tuleap already interact with OAuth2 ATM but only as a consumer with the "OpenID Connect Client" plugin.
The goal of this epic is to make the reverse operation: Tuleap would become OAuth2 provider and, in on top of that, OpenID Connect provider to manage delegation of user identification in addition of permission delegation.
To better understand OAuth2 and OpenID Connect you can have a look at this Illustrated Guide to OAuth and OpenID Connect
Way of working
The current integration of OAuth2 is proposed to be at project level (by project administrators). They will be able to create new "OAuth Apps", that is to say a new delegation authorisation for given 3rd party app (eg. Jenkins) with a given set of scopes (permissions).
In a future version of the feature, we could extend that at User or Site level.
As a project admin
- In project administration, there is a new tab "OAuth Apps"
- I can see all apps already setup and I can create a new one
- When I create a new one, I should provide the standard OAuth2 info (callbacks) + required scopes
- At creation the client secret is displayed only once and will never appear again (like API tokens)
- An OAuth App can be deleted too
- Upon deletion there is a confirmation modale to warn admin that people using this integration will no longer be able to do it.
Once the cliente ID & secret generated by Tuleap, the project admin can configure any OAuth2 compatible app.
As a end-user of the 3rd party app
- When I go on the 3rd party app, at first connexion, I will be redirected on Tuleap to grant authorization
- Note: if I'm not already logged in, Tuleap authenticate me first (regular auth scheme applies)
- Tuleap shows me a screen with the list of permissions requested by the 3rd party app and I can approve or deny
- Whether I approve or deny, I'm redirected toward the 3rd party app and the end of the flow is managed by it.
As a end-user, on Tuleap
- When I go in my user settings, I have the list of the OAuth2 grants I already given (with their scopes) and I can revoke them at anytime.
Everything else is managed behind the scene by the implementation of OAuth2 protocol + OpenID Connect layer for auth.