Add gateway support to awxkit

[gravesm]

SUMMARY

This updates awxkit to add support for gateway when fetching oauth tokens, which is used during the login subcommand. awxkit will first try fetching a token from gateway and if that fails, fallback to existing behavior. This change is backwards compatible.

ISSUE TYPE

• New or Enhanced Feature

COMPONENT NAME

• CLI

AWX VERSION

ADDITIONAL INFORMATION

[webknjaz]

@gravesm Codecov reports only 20.07% of your patched lines being hit: https://app.codecov.io/gh/ansible/awx/pull/15576?flags[0]=pytest. Could you look into increasing the test coverage there?

[AlanCoding]

I think I've gotten to a code problem now.

export CONTROLLER_HOST=https://localhost/
export AWXKIT_API_BASE_PATH=/api/controller/
export AWXKIT_GATEWAY_BASE_PATH=/api/gateway/
export CONTROLLER_USERNAME=admin
export CONTROLLER_VERIFY_SSL=false

then run

$ CONTROLLER_PASSWORD=admin awx login -v
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): localhost:443
DEBUG:urllib3.connectionpool:https://localhost:443 "GET /api/controller/ HTTP/1.1" 200 256
DEBUG:awxkit.api.client:"GET https://localhost/api/controller/" elapsed: 0:00:00.039733
DEBUG:awxkit.api.registry:Retrieved <class 'awxkit.api.pages.api.ApiV2'> by url: /api/controller/v2/
DEBUG:urllib3.connectionpool:https://localhost:443 "GET /api/controller/v2/ HTTP/1.1" 200 2767
DEBUG:awxkit.api.client:"GET https://localhost/api/controller/v2/" elapsed: 0:00:00.033291
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): localhost:443
DEBUG:urllib3.connectionpool:https://localhost:443 "POST /api/gateway/v1/users/admin/personal_tokens/ HTTP/1.1" 405 41
DEBUG:awxkit.api.client:"POST https://localhost/api/gateway/v1/users/admin/personal_tokens/" elapsed: 0:00:00.132728
usage: awx login [-h] [--description TEXT] [--conf.client_id TEXT] [--conf.client_secret TEXT]
                 [--conf.scope {read,write}] [--conf.host https://example.awx.org] [--conf.token TEXT]
                 [--conf.username TEXT] [--conf.password TEXT] [-k]

options:
  -h, --help            show this help message and exit

OAuth2.0 Options:
  --description TEXT    description of the generated OAuth2.0 token
  --conf.client_id TEXT
  --conf.client_secret TEXT
  --conf.scope {read,write}

authentication:
  --conf.host https://example.awx.org
  --conf.token TEXT     an OAuth2.0 token (get one by using `awx login`)
  --conf.username TEXT
  --conf.password TEXT
  -k, --conf.insecure   Allow insecure server connections when using SSL
Error retrieving an OAuth2.0 token (<class 'awxkit.exceptions.MethodNotAllowed'>).

This tries to do what is intended. But then it hits a server error on:

DEBUG:awxkit.api.client:"POST https://localhost/api/gateway/v1/users/admin/personal_tokens/" elapsed: 0:00:00.132728

The server error is handled badly, both on the Gateway side and on the client side.

But this does seem to get us to a high-level problem with the current approach. You can look up a user by its username or ansible_id, which can be had from the controller server. However, none of this can be done unauthenticated, which is the whole point here.

It doesn't look like there is any support for accessing /v1/users/admin/personal_tokens/, and that will require some novel solution involving API changes.

[AlanCoding]

Doesn't work because of API incompatibility, information to move forward should be sufficiently established

[AlanCoding]

https://github.com/ansible/django-ansible-base/blob/b96e64fc293f975f03f411e86ed469c6bd9af509/test_app/tests/oauth2_provider/views/test_token.py#L122-L146

This test seems to give the expected steps for the DAB OAuth2 provider for the "login" flow, where you are unauthenticated, have a username/password, and wish to get a token. ping @relrod @john-westcott-iv

    data = {
        "grant_type": "password",
        "username": "user",
        "password": "password",
        "scope": "read",
    }
    resp = unauthenticated_api_client.post(
        url,
        data=urlencode(data),
        content_type='application/x-www-form-urlencoded',
        headers={'Authorization': 'Basic ' + base64.b64encode(f"{app.client_id}:{secret}".encode()).decode()},
    )

This is done to a url which is /api/v1/tokens/, unlike the AWX case where it used the personal_tokens sublist.

[AlanCoding]

Should still follow up with an issue about that server error

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud