[PATCH v2] credential: new attribute oauth_refresh_token
- From
M Hickford via GitGitGadget <gitgitgadget@gmail.com>
- Date
- Apr 21, 2023, 09:47 UTC
- Message-ID
- <pull.1394.v2.git.1682070479816.gitgitgadget@gmail.com>
- In-Reply-To
- <pull.1394.git.1678776364753.gitgitgadget@gmail.com>
From: M Hickford <mirth.hickford@gmail.com>
Git authentication with OAuth access token is supported by every popular Git host including GitHub, GitLab and BitBucket [1][2][3]. Credential helpers Git Credential Manager (GCM) and git-credential-oauth generate OAuth credentials [4][5]. Following RFC 6749, the application prints a link for the user to authorize access in browser. A loopback redirect communicates the response including access token to the application.
For security, RFC 6749 recommends that OAuth response also includes expiry date and refresh token [6]. After expiry, applications can use the refresh token to generate a new access token without user reauthorization in browser. GitLab and BitBucket set the expiry at two hours [2][3]. (GitHub doesn't populate expiry or refresh token.)
However the Git credential protocol has no attribute to store the OAuth refresh token (unrecognised attributes are silently discarded). This means that the user has to regularly reauthorize the helper in browser. On a browserless system, this is particularly intrusive, requiring a second device.
Introduce a new attribute oauth_refresh_token. This is especially useful when a storage helper and a read-only OAuth helper are configured together. Recall that `credential fill` calls each helper until it has a non-expired password.
``` [credential] helper = storage # eg. cache or osxkeychain helper = oauth ```
The OAuth helper can use the stored refresh token forwarded by `credential fill` to generate a fresh access token without opening the browser. See https://github.com/hickford/git-credential-oauth/pull/3/files for an implementation tested with this patch.
Add support for the new attribute to credential-cache. Eventually, I hope to see support in other popular storage helpers.
Alternatives considered: ask helpers to store all unrecognised attributes. This seems excessively complex for no obvious gain. Helpers would also need extra information to distinguish between confidential and non-confidential attributes.
Workarounds: GCM abuses the helper get/store/erase contract to store the refresh token during credential *get* as the password for a fictitious host [7] (I wrote this hack). This workaround is only feasible for a monolithic helper with its own storage.
[1] https://github.blog/2012-09-21-easier-builds-and-deployments-using-git-over-https-and-oauth/ [2] https://docs.gitlab.com/ee/api/oauth2.html#access-git-over-https-with-access-token [3] https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/#Cloning-a-repository-with-an-access-token [4] https://github.com/GitCredentialManager/git-credential-manager [5] https://github.com/hickford/git-credential-oauth [6] https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 [7] https://github.com/GitCredentialManager/git-credential-manager/blob/66b94e489ad8cc1982836355493e369770b30211/src/shared/GitLab/GitLabHostProvider.cs#L207
Signed-off-by: M Hickford <mirth.hickford@gmail.com>
---
credential: new attribute oauth_refresh_token
A minimal extension to the credential protocol to communicate OAuth
refresh token. This is worthwhile because OAuth for Git authentication
is ubiquitous. Current workaround is only feasible for a monolithic
credential helper, discouraging interoperability between helpers.
Patch v2 adds an additional testPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-1394%2Fhickford%2Fcredential-refresh-token-v2 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1394/hickford/credential-refresh-token-v2 Pull-Request: https://github.com/gitgitgadget/git/pull/1394
Range-diff vs v1:
1: 299a26919f0 ! 1: 79e77a4426b credential: new attribute oauth_refresh_token
@@ credential.c: void credential_clear(struct credential *c)
free(c->password);
+ free(c->oauth_refresh_token);
string_list_clear(&c->helpers, 0);
+ strvec_clear(&c->wwwauth_headers);
- credential_init(c);
@@ credential.c: int credential_read(struct credential *c, FILE *fp)
c->password_expiry_utc = parse_timestamp(value, NULL, 10);
if (c->password_expiry_utc == 0 || errno == ERANGE)
@@ credential.h: struct credential {
};
+ ## t/lib-credential.sh ##
+@@ t/lib-credential.sh: helper_test_clean() {
+ reject $1 https example.com store-user
+ reject $1 https example.com user1
+ reject $1 https example.com user2
++ reject $1 https example.com user4
+ reject $1 http path.tld user
+ reject $1 https timeout.tld user
+ reject $1 https sso.tld
+@@ t/lib-credential.sh: helper_test_timeout() {
+ '
+ }
+
++helper_test_oauth_refresh_token() {
++ HELPER=$1
++
++ test_expect_success "helper ($HELPER) stores oauth_refresh_token" '
++ check approve $HELPER <<-\EOF
++ protocol=https
++ host=example.com
++ username=user4
++ password=pass
++ oauth_refresh_token=xyzzy
++ EOF
++ '
++
++ test_expect_success "helper ($HELPER) gets oauth_refresh_token" '
++ check fill $HELPER <<-\EOF
++ protocol=https
++ host=example.com
++ username=user4
++ --
++ protocol=https
++ host=example.com
++ username=user4
++ password=pass
++ oauth_refresh_token=xyzzy
++ --
++ EOF
++ '
++}
++
+ write_script askpass <<\EOF
+ echo >&2 askpass: $*
+ what=$(echo $1 | cut -d" " -f1 | tr A-Z a-z | tr -cd a-z)
+
## t/t0300-credentials.sh ##
@@ t/t0300-credentials.sh: test_expect_success 'credential_approve stores password expiry' '
EOF
@@ t/t0300-credentials.sh: test_expect_success 'credential_approve stores password
test_expect_success 'do not bother storing password-less credential' '
check approve useless <<-\EOF
protocol=http
+
+ ## t/t0301-credential-cache.sh ##
+@@ t/t0301-credential-cache.sh: test_atexit 'git credential-cache exit'
+
+ # test that the daemon works with no special setup
+ helper_test cache
++helper_test_oauth_refresh_token cache
+
+ test_expect_success 'socket defaults to ~/.cache/git/credential/socket' '
+ test_when_finished "Documentation/git-credential.txt | 6 ++++++ builtin/credential-cache--daemon.c | 3 +++ credential.c | 6 ++++++ credential.h | 1 + t/lib-credential.sh | 30 ++++++++++++++++++++++++++++++ t/t0300-credentials.sh | 18 ++++++++++++++++++ t/t0301-credential-cache.sh | 1 + 7 files changed, 65 insertions(+)
diff --git a/Documentation/git-credential.txt b/Documentation/git-credential.txt index 3394c036113..0e6d9e85ec7 100644 --- a/Documentation/git-credential.txt +++ b/Documentation/git-credential.txt @@ -156,6 +156,12 @@ Git understands the following attributes: When reading credentials from helpers, `git credential fill` ignores expired passwords. Represented as Unix time UTC, seconds since 1970. +`oauth_refresh_token`:: + + An OAuth refresh token may accompany a password that is an OAuth access + token. Helpers must treat this attribute as confidential like the password + attribute. Git itself has no special behaviour for this attribute. + `url`:: When this special attribute is read by `git credential`, the diff --git a/builtin/credential-cache--daemon.c b/builtin/credential-cache--daemon.c index 62c09a271d6..9db5f00184d 100644 --- a/builtin/credential-cache--daemon.c +++ b/builtin/credential-cache--daemon.c @@ -133,6 +133,9 @@ static void serve_one_client(FILE *in, FILE *out) if (e->item.password_expiry_utc != TIME_MAX) fprintf(out, "password_expiry_utc=%"PRItime"\n", e->item.password_expiry_utc); + if (e->item.oauth_refresh_token) + fprintf(out, "oauth_refresh_token=%s\n", + e->item.oauth_refresh_token); } } else if (!strcmp(action.buf, "exit")) { diff --git a/credential.c b/credential.c index e6417bf8804..84e32971a92 100644 --- a/credential.c +++ b/credential.c @@ -24,6 +24,7 @@ void credential_clear(struct credential *c) free(c->path); free(c->username); free(c->password); + free(c->oauth_refresh_token); string_list_clear(&c->helpers, 0); strvec_clear(&c->wwwauth_headers); @@ -243,6 +244,9 @@ int credential_read(struct credential *c, FILE *fp) c->password_expiry_utc = parse_timestamp(value, NULL, 10); if (c->password_expiry_utc == 0 || errno == ERANGE) c->password_expiry_utc = TIME_MAX; + } else if (!strcmp(key, "oauth_refresh_token")) { + free(c->oauth_refresh_token); + c->oauth_refresh_token = xstrdup(value); } else if (!strcmp(key, "url")) { credential_from_url(c, value); } else if (!strcmp(key, "quit")) { @@ -278,6 +282,7 @@ void credential_write(const struct credential *c, FILE *fp) credential_write_item(fp, "path", c->path, 0); credential_write_item(fp, "username", c->username, 0); credential_write_item(fp, "password", c->password, 0); + credential_write_item(fp, "oauth_refresh_token", c->oauth_refresh_token, 0); if (c->password_expiry_utc != TIME_MAX) { char *s = xstrfmt("%"PRItime, c->password_expiry_utc); credential_write_item(fp, "password_expiry_utc", s, 0); @@ -403,6 +408,7 @@ void credential_reject(struct credential *c) FREE_AND_NULL(c->username); FREE_AND_NULL(c->password); + FREE_AND_NULL(c->oauth_refresh_token); c->password_expiry_utc = TIME_MAX; c->approved = 0; } diff --git a/credential.h b/credential.h index 2b5958cd431..b8e2936d1dc 100644 --- a/credential.h +++ b/credential.h @@ -141,6 +141,7 @@ struct credential { char *protocol; char *host; char *path; + char *oauth_refresh_token; timestamp_t password_expiry_utc; }; diff --git a/t/lib-credential.sh b/t/lib-credential.sh index 5ea8bc9f1dc..33666406d92 100644 --- a/t/lib-credential.sh +++ b/t/lib-credential.sh @@ -43,6 +43,7 @@ helper_test_clean() { reject $1 https example.com store-user reject $1 https example.com user1 reject $1 https example.com user2 + reject $1 https example.com user4 reject $1 http path.tld user reject $1 https timeout.tld user reject $1 https sso.tld @@ -298,6 +299,35 @@ helper_test_timeout() { ' } +helper_test_oauth_refresh_token() { + HELPER=$1 + + test_expect_success "helper ($HELPER) stores oauth_refresh_token" ' + check approve $HELPER <<-\EOF + protocol=https + host=example.com + username=user4 + password=pass + oauth_refresh_token=xyzzy + EOF + ' + + test_expect_success "helper ($HELPER) gets oauth_refresh_token" ' + check fill $HELPER <<-\EOF + protocol=https + host=example.com + username=user4 + -- + protocol=https + host=example.com + username=user4 + password=pass + oauth_refresh_token=xyzzy + -- + EOF + ' +} + write_script askpass <<\EOF echo >&2 askpass: $* what=$(echo $1 | cut -d" " -f1 | tr A-Z a-z | tr -cd a-z) diff --git a/t/t0300-credentials.sh b/t/t0300-credentials.sh index c66d91e82d8..b49fc14a2bd 100755 --- a/t/t0300-credentials.sh +++ b/t/t0300-credentials.sh @@ -214,6 +214,24 @@ test_expect_success 'credential_approve stores password expiry' ' EOF ' +test_expect_success 'credential_approve stores oauth refresh token' ' + check approve useless <<-\EOF + protocol=http + host=example.com + username=foo + password=bar + oauth_refresh_token=xyzzy + -- + -- + useless: store + useless: protocol=http + useless: host=example.com + useless: username=foo + useless: password=bar + useless: oauth_refresh_token=xyzzy + EOF +' + test_expect_success 'do not bother storing password-less credential' ' check approve useless <<-\EOF protocol=http diff --git a/t/t0301-credential-cache.sh b/t/t0301-credential-cache.sh index 698b7159f03..c02a3b5969c 100755 --- a/t/t0301-credential-cache.sh +++ b/t/t0301-credential-cache.sh @@ -29,6 +29,7 @@ test_atexit 'git credential-cache exit' # test that the daemon works with no special setup helper_test cache +helper_test_oauth_refresh_token cache test_expect_success 'socket defaults to ~/.cache/git/credential/socket' ' test_when_finished " base-commit: 667fcf4e15379790f0b609d6a83d578e69f20301
-- gitgitgadget