GitHub Integrations Authentication Workflow #455

Activity

1. bradleyfalzon commented on Oct 21, 2016

   

   bradleyfalzon

   on Oct 21, 2016

   Last edited by bradleyfalzon

   ContributorAuthor

   More actions

   So to provide this via a http.RoundTripper, I've done:

   // acceptHeader is the GitHub Integrations Preview Accept header.
   const acceptHeader = "application/vnd.github.machine-man-preview+json"
   
   // installationTransport provides a http.RoundTripper by wrapping an existing
   // http.RoundTripper (that's shared between multiple installation transports to
   // reuse underlying http connections), but provides GitHub Integration
   // authentication as an installation.
   //
   // See https://developer.github.com/early-access/integrations/authentication/#as-an-installation
   type installationTransport struct {
           tr             http.RoundTripper // tr is the underlying roundtripper being wrapped
           keyFile        string            // keyFile is the path to GitHub Intregration's PEM encoded private key
           integrationID  int               // integrationID is the GitHub Integration's Installation ID
           installationID int               // installationID is the GitHub Integration's Installation ID
           token          *accessToken      // token is the installation's access token
   }
   
   // accessToken is an installation access token
   type accessToken struct {
           Token     string    `json:"token"`
           ExpiresAt time.Time `json:"expires_at"`
   }
   
   func (t *installationTransport) RoundTrip(req *http.Request) (*http.Response, error) {
           if t.token == nil || t.token.ExpiresAt.Add(-time.Minute).Before(time.Now()) {
                   // Token is not set or expired/nearly expired, so refresh
                   if err := t.refreshToken(); err != nil {
                           return nil, errors.Wrap(err, "could not refresh installation token")
                   }
           }
   
           req.Header.Set("Authorization", "token "+t.token.Token)
           req.Header.Set("Accept", acceptHeader)
           resp, err := t.tr.RoundTrip(req)
           return resp, err
   }
   
   func (t *installationTransport) refreshToken() error {
           // TODO these claims could probably be reused between installations before expiry
           claims := &jwt.StandardClaims{
                   IssuedAt:  time.Now().Unix(),
                   ExpiresAt: time.Now().Add(time.Minute).Unix(),
                   Issuer:    strconv.Itoa(t.integrationID),
           }
           bearer := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
   
           key, err := ioutil.ReadFile(t.keyFile)
           if err != nil {
                   return errors.Wrap(err, "could not read private key")
           }
   
           privateKey, err := jwt.ParseRSAPrivateKeyFromPEM(key)
           if err != nil {
                   return errors.Wrap(err, "could not parse private key")
           }
   
           ss, err := bearer.SignedString(privateKey)
           if err != nil {
                   return errors.Wrap(err, "could not sign jwt")
           }
   
           req, err := http.NewRequest("POST", fmt.Sprintf("https://api.github.com/installations/%v/access_tokens", t.installationID), nil)
           if err != nil {
                   return errors.Wrap(err, "could not create request")
           }
           req.Header.Set("Authorization", fmt.Sprintf("Bearer %v", ss))
           req.Header.Set("Accept", acceptHeader)
   
           client := &http.Client{}
           resp, err := client.Do(req)
           if err != nil {
                   return errors.Wrap(err, "could not get access_tokens")
           }
           defer resp.Body.Close()
   
           if resp.StatusCode < 200 || resp.StatusCode >= 300 {
                   return fmt.Errorf("received response status %q when fetching %v", resp.Status, req.URL)
           }
   
           if err := json.NewDecoder(resp.Body).Decode(&t.token); err != nil {
                   return err
           }
   
           return nil
   }

   Above is missing constructor as my implementation is slightly more complicated, can provide a simpler version if required.

   To use this:

   tr := http.DefaultTransport // shared for every installation
   
   // Per installation
   itr := NewInstallationTransport(IntegrationID, InstallationID, KeyFile, tr)
   client := &http.Client{Transport: itr}
   gh := github.NewClient(client)
   // gh will now manage authentication as an installation as defined by Integration Authentication

   This generally works in dev, but hasn't been tested completely (in particular, I believe the TCP connections should be reused, but I haven't actually tested this), and I haven't ran this long enough to know tokens are refreshed, there's also an opportunity to split the refresh tokens into two steps to provide the ability to authenticate as an integration too (although the only use I have for it so far it to fetch tokens), I'm not a developer and little experience with GitHub APIs and this package so there maybe better options, and it's not clear on how rate limits are being implemented by GitHub right now (per integration rate limit or per installation). Feedback appreciated.

   I'd like to know how this project would want to provide authentication for Integrations, as I know it doesn't currently provide OAuth, however, perhaps providing a similar transport would help people (there are a lot of steps specific to GitHub). If the project doesn't want to provide this (I can understand, I'll be glad to provide it as an external package).

   Thanks
2. bradleyfalzon commented on Oct 27, 2016

   

   bradleyfalzon

   on Oct 27, 2016

   Last edited by bradleyfalzon

   ContributorAuthor

   More actions

   Hi,

   I've provided this via a work-in-progress external package in the meantime: https://github.com/bradleyfalzon/ghinstallation

   Feedback welcome, but for the moment, will close the issue.

   Thanks

   👍React with 👍1Reacted by Dmitri Shuralyov
3. bradleyfalzon

   closed this as completedon Oct 27, 2016
4. dmitshur

   added a commit that references this issue on Jun 4, 2017

   doc: Add link to GitHub Apps authentication package. (#649)

   ...

   7a51fb9
5. bubg-dev

   added a commit that references this issue on Jun 16, 2017

   doc: Add link to GitHub Apps authentication package. (google#649)

   ...

   7780993
6. jlaportebot

   added a commit that references this issue on Jun 28, 2026

   doc: Add link to GitHub Apps authentication package. (google#649)

   ...

   d868dff