ansible/awx

Add Client Credentials Grant oauth2 authorization type

Open

#6,719 opened on Apr 15, 2020

View on GitHub
 (0 comments) (4 reactions) (0 assignees)Python (3,333 forks)batch import
component:apihelp wantedtype:enhancement

Repository metrics

Stars
 (13,071 stars)
PR merge metrics
 (Avg merge 24d 6h) (30 merged PRs in 30d)

Description

ISSUE TYPE
  • Add Client Credentials Grant oauth2 authorization
SUMMARY

Currently, if I want to connect an application to AWX API for machine to machine connections, I need to use password grant type authentication. It's probably possible to use authorization code or personal access tokens but they are not designed for machine to machine.

Using Password Grant is not recommended for machine to machine for security reasons.
Client Credentials Grant oauth2 authorization is what is recommended for machine to machine. https://tools.ietf.org/html/rfc6749#section-1.3.3

Contributor guide

Research direction
Examine the existing OAuth2 authentication system in AWX (likely using Django OAuth Toolkit) and implement the Client Credentials Grant flow, updating the token endpoint and adding necessary permissions checks.
Tech stack
python
Domain
authenticationauthorizationbackend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PythonOAuth2
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40