Updating authenticators from latest in Tiled by davidpcls · Pull Request #81 · bluesky/bluesky-httpserver

davidpcls · 2026-01-29T20:29:31Z

Description

These changes bring in the authenticators from Tiled into HTTP Bluesky. This allows us to use the same authentication setup as from Tiled deployments (at least at the current moment). The main other change is to remove the "mode" flag and instead use the class type to determine if it is an internal or external authenticator.

Part of this work is also the updating of the bluesky-queueserver-api, for which I have created a PR. Both are required in order for the OIDC workflows to work.

Motivation and Context

This solves the problem of having different authentication schemes to maintain between Tiled and HTTP server, which came from the same code around 3 years ago. Tiled has been updated but HTTP server was not. This addresses that.

Summary of Changes for Release Notes

Updated authenticators based off Tiled main.
Made minimal changes to app.py and authentication.py to support the changes. Some new endpoints needed to be created to do this, but fairly minimal. The majority of the work was getting the unit test runners stable.
Added local parallel unit test runners to aid development
Updated the github runners to be more stable and reliable.

Fixed

Added

Authenticators.py from Tiled (fd2a646e4ec73e08fb206f18deaa51c166ccd37a)
new endpoints for authorization workflows in app.py
Pending sessions in the database
Documentation and examples on using OIDC based off Tiled

Changed

Unit tests to support above changes
Unit test structure to be a little more stable
The LDAP container as the previous one was no longer supported

Removed

How Has This Been Tested?

Testing was done against MS Entra. I tested that these workflows work for both internal (localhost) and external servers. Using this the login workflow changes to just simply being:

from bluesky_queueserver_api.http import REManagerAPI
from bluesky_queueserver_api import BPlan
RM = REManagerAPI(http_server_uri="http://localhost:60610", http_auth_provider="entra/authorize")
RM.login()

At which point the user will be logged in and can immediately issue the RM.status(). If the user does not already have an authenticated session in their browser they will need to login and they will be prompted to do so.

While this was tested with MS Entra, the design is based on Tiled's OIDC and testing used the OIDC flow with MS Entra, so it should theoretically work with both.

danielballan · 2026-02-03T15:34:55Z

Wow, thanks @davidpcls!

dmgav · 2026-02-03T16:50:50Z

Thank you. I am going to try to fix the unit tests first, I may push a few commits.

prjemian · 2026-02-03T17:40:01Z

If either of you intend to commit more work to this PR, put it in Draft mode. Change the mode back when you are ready for final review.

davidpcls · 2026-02-03T17:42:15Z

@prjemian , thanks I've converted it.

@dmgav sure that sounds good.

dmgav · 2026-02-05T16:53:03Z

I fixed the unit tests. I also rebased the branch to main, so I had to force push the changes.

davidpcls · 2026-02-17T16:00:15Z

Thanks for working on that @dmgav! I just got things setup so I can test with this against MS Entra, so I'll go about verifying there are no other changes required for this to work properly. Took a little longer than expected to get the Entra stuff worked out.

This is working okay, although it doens't really work smoothly for the API based login and the http command based login isn't great, as it requires the user to copy and past token around. Compared to ldap which just logs the user in. So still some work to do here to smooth out the user experience.

This solves the problem that what was implemented was actually authenticating the application and not the user like expected. It worked but it required that the user input a code. This solves that problem so that when you click the login link, if you are already logged in with you SSO provider you'll just automatically log in to the HTTP Server. Likewise if you use the bluesky queueserver api, when you call RM.Login you'll automatically be logged in, no user interaction required.

These should correct some of the problems in the last CI workflow. I moved the LDAP and docker image into the continuous_integration folder so it matches tiled.

This addresses documentation problems, the levels were incorrect as I did not understand what the next level should have been in the docs. I've also updated the usage documentation a little to be more useful.

These allow for running the unit tests in a containerized system just like how they are done in the ci pipeline, but locally and in a way that can maximize processor usage and minimize runtime.

Testing with ms entra

davidpcls · 2026-03-13T18:05:31Z

I've added in these changes, I'm going to work on cleaning up failing unit tests now and then I will update the pull request description to match your style and provide information on testing. After that I will remove the WIP status.

davidpcls · 2026-03-13T18:06:49Z

Please also see the related PR for the API: bluesky/bluesky-queueserver-api#62

This is a set of test changes intended to improve the reliability of unit testing, as the current unit tests are randomly failing due to test design. Primarily this appears to be centered around LDAP. So this work was to: * Fix for ldap errors * Hardening unit tests so they fail less frequency * Try to handle console output more reliably

davidpcls · 2026-03-20T19:59:02Z

Sorry, got excited about the unit tests passing. I need to do one last integration test first, which is why I converted it back into a WIP

davidpcls · 2026-03-20T20:41:16Z

@dmgav , I've now tested this on remote machines and with httpserver running locally and both work. Let me know if you want an example. I'm not adding a whole lot here for evidence just because I'm not entirely sure what could be leaking security-sensitive information out.

danielballan · 2026-05-22T16:52:46Z

@davidpcls With Tiled v0.2.10 (released this morning) we addressed several issues in OIDC authentication. I think it would make sense to incorporate those fixes in this PR, so that QS will be fully caught up. Do you have capacity to take that on?

See the diff in tiled.authenticators and tiled.server.authentication between v0.2.9 and v0.2.10.

davidpcls · 2026-05-25T16:19:39Z

@danielballan, I'll take a look and see if it's something I can do. The unit tests are usually the hard part here as they take a long time to run, if anyone wants to tackle improving that it would help immensely.

checkmarx-gh-ast-us-povs · 2026-05-25T19:24:40Z

Checkmarx One – Scan Summary & Details – a0210fce-3a46-44d9-b2ce-56dfc68132b2

New Issues (6)

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	Passwords And Secrets - Generic Password	/ldap-docker-compose.yml: 10	details Query to find passwords and secrets in infrastructure code. `ID: 0uORs8s6P6h1jOJEMOa3uIr6F5k%3D`
2	Container Capabilities Unrestricted	/ldap-docker-compose.yml: 2	details Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec... `ID: j%2Fx7zqyqeGV5OT6YextuGFOrQx0%3D`
3	Container Traffic Not Bound To Host Interface	/ldap-docker-compose.yml: 4	details Incoming container traffic should be bound to a specific host interface `ID: 4cqgOfD5LWmOrO%2FoHwOJyK90ZSc%3D`
4	Healthcheck Not Set	/ldap-docker-compose.yml: 2	details Check containers periodically to see if they are running properly. `ID: SbI1wM7bsqAma%2BzrlWGZKGM%2F%2BH0%3D`
5	Privileged Ports Mapped In Container	/ldap-docker-compose.yml: 4	details Privileged ports (1 to 1023) should not be mapped. Also you should drop net_bind_service linux capability from the container unless you absolu... `ID: hpFU1vm8AZBeQTJYYs4wkm%2Foy2E%3D`
6	Security Opt Not Set	/ldap-docker-compose.yml: 2	details Attribute 'security_opt' should be defined. `ID: 9gd0q%2Ft8iSnz4NBVRq7X6%2BeSzQc%3D`

Fixed Issues (9)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~Passwords And Secrets - Generic Password~~	/ldap-docker-compose.yml: 11
	~~Container Capabilities Unrestricted~~	/ldap-docker-compose.yml: 4
	~~Container Traffic Not Bound To Host Interface~~	/ldap-docker-compose.yml: 6
	~~Healthcheck Not Set~~	/ldap-docker-compose.yml: 4
	~~Memory Not Limited~~	/ldap-docker-compose.yml: 4
	~~Pids Limit Not Set~~	/ldap-docker-compose.yml: 4
	~~Security Opt Not Set~~	/ldap-docker-compose.yml: 4
	~~Use_Of_Hardcoded_Password~~	bluesky_httpserver/authentication.py: 59
	~~Cpus Not Limited~~	/ldap-docker-compose.yml: 4

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

davidpcls · 2026-05-28T20:27:01Z

@danielballan, I think this is going to take a little bit, as I won't be able to work on this for a couple weeks and I've not made huge progress so far. If you need to get this going I'd suggest someone else take over integrating in the latest from Tiled. If not I'll work on it later.

danielballan requested a review from dmgav February 3, 2026 15:34

danielballan requested a review from sligara7 February 3, 2026 15:35

davidpcls marked this pull request as draft February 3, 2026 17:41

davidpcls and others added 2 commits February 4, 2026 10:33

Updating authenticators from latest in Tiled

c474afd

TST: fix unit tests

f54ef36

dmgav force-pushed the auth_updates_from_tiled branch from 579d82a to f54ef36 Compare February 5, 2026 16:21

STY: reformat with black

be73eda

davidpcls added 10 commits February 17, 2026 15:04

Removing some unnecessary code.

d90ad0c

Fixes from running black

96cd9db

Adding documentation on how to use OIDC

967fcba

Fixes for unit tests, moving start LDAP

5906b28

These should correct some of the problems in the last CI workflow. I moved the LDAP and docker image into the continuous_integration folder so it matches tiled.

fixing pre-commit issues

28483f9

fixing documentation issues

a4551e3

This addresses documentation problems, the levels were incorrect as I did not understand what the next level should have been in the docs. I've also updated the usage documentation a little to be more useful.

Adding in helper scripts for testing

8fa89ab

These allow for running the unit tests in a containerized system just like how they are done in the ci pipeline, but locally and in a way that can maximize processor usage and minimize runtime.

Merge pull request #2 from davidpcls/testing_with_ms_entra

318ab48

Testing with ms entra

davidpcls marked this pull request as ready for review March 20, 2026 19:54

davidpcls changed the title ~~WIP - Updating authenticators from latest in Tiled~~ Updating authenticators from latest in Tiled Mar 20, 2026

davidpcls marked this pull request as draft March 20, 2026 19:58

davidpcls marked this pull request as ready for review March 20, 2026 20:39

Merge branch 'main' into auth_updates_from_tiled

2a12569

Conversation

davidpcls commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Motivation and Context

Summary of Changes for Release Notes

Fixed

Added

Changed

Removed

How Has This Been Tested?

Uh oh!

danielballan commented Feb 3, 2026

Uh oh!

dmgav commented Feb 3, 2026

Uh oh!

prjemian commented Feb 3, 2026

Uh oh!

davidpcls commented Feb 3, 2026

Uh oh!

dmgav commented Feb 5, 2026

Uh oh!

davidpcls commented Feb 17, 2026

Uh oh!

davidpcls commented Mar 13, 2026

Uh oh!

davidpcls commented Mar 13, 2026

Uh oh!

davidpcls commented Mar 20, 2026

Uh oh!

davidpcls commented Mar 20, 2026

Uh oh!

danielballan commented May 22, 2026

Uh oh!

davidpcls commented May 25, 2026

Uh oh!

checkmarx-gh-ast-us-povs Bot commented May 25, 2026

Uh oh!

davidpcls commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

davidpcls commented Jan 29, 2026 •

edited

Loading