Client Login via device authorization flow (#309)

UI and CLI Clients are now able to use SSO login by default

we will check if the management has configured or supports SSO providers

daemon will handle fetching and waiting for an access token

Oauth package was moved to internal to avoid one extra package at this stage

Secrets were removed from OAuth

CLI clients have less and better output

2 new status were introduced, NeedsLogin and FailedLogin for better messaging

With NeedsLogin we no longer have endless login attempts

client/cmd/down.go

@@ -17,7 +17,7 @@ var downCmd = &cobra.Command{
 	RunE: func(cmd *cobra.Command, args []string) error {
 		SetFlagsFromEnvVars()
 
-		err := util.InitLog(logLevel, logFile)
+		err := util.InitLog(logLevel, "console")
 		if err != nil {
 			log.Errorf("failed initializing log %v", err)
 			return err

client/cmd/login.go

@@ -3,10 +3,13 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"github.com/skratchdot/open-golang/open"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+	"time"
 
 	"github.com/netbirdio/netbird/util"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 
 	"github.com/netbirdio/netbird/client/internal"
@@ -19,10 +22,9 @@ var loginCmd = &cobra.Command{
 	RunE: func(cmd *cobra.Command, args []string) error {
 		SetFlagsFromEnvVars()
 
-		err := util.InitLog(logLevel, logFile)
+		err := util.InitLog(logLevel, "console")
 		if err != nil {
-			log.Errorf("failed initializing log %v", err)
-			return err
+			return fmt.Errorf("failed initializing log %v", err)
 		}
 
 		ctx := internal.CtxInitState(context.Background())
@@ -31,45 +33,162 @@ var loginCmd = &cobra.Command{
 		if logFile == "console" {
 			config, err := internal.GetConfig(managementURL, adminURL, configPath, preSharedKey)
 			if err != nil {
-				log.Errorf("get config file: %v", err)
-				return err
+				return fmt.Errorf("get config file: %v", err)
 			}
-			err = WithBackOff(func() error {
-				return internal.Login(ctx, config, setupKey, jwtToken)
-			})
-			if err != nil {
-				log.Errorf("backoff cycle failed: %v", err)
-			}
-			return err
-		}
 
-		if setupKey == "" {
-			log.Error("setup key can't be empty")
-			return fmt.Errorf("empty setup key")
+			err = foregroundLogin(ctx, cmd, config, setupKey)
+			if err != nil {
+				return fmt.Errorf("foreground login failed: %v", err)
+			}
+			cmd.Println("Logging successfully")
+			return nil
 		}
 
 		conn, err := DialClientGRPCServer(ctx, daemonAddr)
 		if err != nil {
-			log.Errorf("failed to connect to service CLI interface %v", err)
-			return err
+			return fmt.Errorf("failed to connect to daemon error: %v\n"+
+				"If the daemon is not running please run: "+
+				"\nnetbird service install \nnetbird service start\n", err)
 		}
 		defer conn.Close()
 
-		request := proto.LoginRequest{
+		client := proto.NewDaemonServiceClient(conn)
+
+		loginRequest := proto.LoginRequest{
 			SetupKey:      setupKey,
 			PreSharedKey:  preSharedKey,
 			ManagementUrl: managementURL,
 		}
-		client := proto.NewDaemonServiceClient(conn)
+
+		var loginErr error
+
+		var loginResp *proto.LoginResponse
+
 		err = WithBackOff(func() error {
-			if _, err := client.Login(ctx, &request); err != nil {
-				log.Errorf("try login: %v", err)
+			var backOffErr error
+			loginResp, backOffErr = client.Login(ctx, &loginRequest)
+			if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
+				s.Code() == codes.PermissionDenied ||
+				s.Code() == codes.NotFound ||
+				s.Code() == codes.Unimplemented) {
+				loginErr = backOffErr
+				return nil
 			}
-			return err
+			return backOffErr
 		})
 		if err != nil {
-			log.Errorf("backoff cycle failed: %v", err)
+			return fmt.Errorf("login backoff cycle failed: %v", err)
 		}
-		return err
+
+		if loginErr != nil {
+			return fmt.Errorf("login failed: %v", loginErr)
+		}
+
+		if loginResp.NeedsSSOLogin {
+			openURL(cmd, loginResp.VerificationURI, loginResp.VerificationURIComplete, loginResp.UserCode)
+
+			_, err = client.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{UserCode: loginResp.UserCode})
+			if err != nil {
+				return fmt.Errorf("waiting sso login failed with: %v", err)
+			}
+		}
+
+		cmd.Println("Logging successfully")
+
+		return nil
 	},
 }
+
+func foregroundLogin(ctx context.Context, cmd *cobra.Command, config *internal.Config, setupKey string) error {
+	needsLogin := false
+
+	err := WithBackOff(func() error {
+		err := internal.Login(ctx, config, "", "")
+		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
+			needsLogin = true
+			return nil
+		}
+		return err
+	})
+	if err != nil {
+		return fmt.Errorf("backoff cycle failed: %v", err)
+	}
+
+	jwtToken := ""
+	if setupKey == "" && needsLogin {
+		tokenInfo, err := foregroundGetTokenInfo(ctx, cmd, config)
+		if err != nil {
+			return fmt.Errorf("interactive sso login failed: %v", err)
+		}
+		jwtToken = tokenInfo.AccessToken
+	}
+
+	err = WithBackOff(func() error {
+		err := internal.Login(ctx, config, setupKey, jwtToken)
+		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
+			return nil
+		}
+		return err
+	})
+	if err != nil {
+		return fmt.Errorf("backoff cycle failed: %v", err)
+	}
+
+	return nil
+}
+
+func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *internal.Config) (*internal.TokenInfo, error) {
+	providerConfig, err := internal.GetDeviceAuthorizationFlowInfo(ctx, config)
+	if err != nil {
+		s, ok := gstatus.FromError(err)
+		if ok && s.Code() == codes.NotFound {
+			return nil, fmt.Errorf("no SSO provider returned from management. " +
+				"If you are using hosting Netbird see documentation at " +
+				"https://github.com/netbirdio/netbird/tree/main/management for details")
+		} else if ok && s.Code() == codes.Unimplemented {
+			mgmtURL := managementURL
+			if mgmtURL == "" {
+				mgmtURL = internal.ManagementURLDefault().String()
+			}
+			return nil, fmt.Errorf("the management server, %s, does not support SSO providers, "+
+				"please update your servver or use Setup Keys to login", mgmtURL)
+		} else {
+			return nil, fmt.Errorf("getting device authorization flow info failed with error: %v", err)
+		}
+	}
+
+	hostedClient := internal.NewHostedDeviceFlow(
+		providerConfig.ProviderConfig.Audience,
+		providerConfig.ProviderConfig.ClientID,
+		providerConfig.ProviderConfig.Domain,
+	)
+
+	flowInfo, err := hostedClient.RequestDeviceCode(context.TODO())
+	if err != nil {
+		return nil, fmt.Errorf("getting a request device code failed: %v", err)
+	}
+
+	openURL(cmd, flowInfo.VerificationURI, flowInfo.VerificationURIComplete, flowInfo.UserCode)
+
+	waitTimeout := time.Duration(flowInfo.ExpiresIn)
+	waitCTX, c := context.WithTimeout(context.TODO(), waitTimeout*time.Second)
+	defer c()
+
+	tokenInfo, err := hostedClient.WaitToken(waitCTX, flowInfo)
+	if err != nil {
+		return nil, fmt.Errorf("waiting for browser login failed: %v", err)
+	}
+
+	return &tokenInfo, nil
+}
+
+func openURL(cmd *cobra.Command, verificationURI, verificationURIComplete, userCode string) {
+	err := open.Run(verificationURIComplete)
+	if err != nil {
+		cmd.Println("Unable to open the default browser.")
+		cmd.Println("If this is not an interactive shell, you may want to use the setup key, see https://www.netbird.io/docs/overview/setup-keys")
+		cmd.Printf("Otherwise, you can continue the login flow by accessing the url below:\n\t%s\n", verificationURI)
+		cmd.Printf("Use the access code: %s\n", userCode)
+		cmd.Println("Or press CTRL + C or COMMAND + C")
+	}
+}

client/cmd/root.go

@@ -30,12 +30,12 @@ var (
 	managementURL     string
 	adminURL          string
 	setupKey          string
-	jwtToken          string
 	preSharedKey      string
 	rootCmd           = &cobra.Command{
-		Use:   "wiretrustee",
-		Short: "",
-		Long:  "",
+		Use:          "wiretrustee",
+		Short:        "",
+		Long:         "",
+		SilenceUsage: true,
 	}
 )
 

client/cmd/service_controller.go

@@ -47,7 +47,7 @@ func (p *program) Start(svc service.Service) error {
 		defer listen.Close()
 
 		if split[0] == "unix" {
-			err = os.Chmod(split[1], 0o666)
+			err = os.Chmod(split[1], 0666)
 			if err != nil {
 				log.Errorf("failed setting daemon permissions: %v", split[1])
 				return
@@ -56,7 +56,7 @@ func (p *program) Start(svc service.Service) error {
 
 		serverInstance := server.New(p.ctx, managementURL, adminURL, configPath, logFile)
 		if err := serverInstance.Start(); err != nil {
-			log.Fatalf("failed start daemon: %v", err)
+			log.Fatalf("failed to start daemon: %v", err)
 		}
 		proto.RegisterDaemonServiceServer(p.serv, serverInstance)
 

client/cmd/service_installer.go

@@ -24,6 +24,11 @@ var installCmd = &cobra.Command{
 			logLevel,
 		}
 
+		if managementURL != "" {
+			svcConfig.Arguments = append(svcConfig.Arguments, "--management-url")
+			svcConfig.Arguments = append(svcConfig.Arguments, managementURL)
+		}
+
 		if runtime.GOOS == "linux" {
 			// Respected only by systemd systems
 			svcConfig.Dependencies = []string{"After=network.target syslog.target"}

client/cmd/status.go

@@ -2,9 +2,9 @@ package cmd
 
 import (
 	"context"
+	"fmt"
 	"github.com/netbirdio/netbird/util"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/status"
 
@@ -20,26 +20,32 @@ var statusCmd = &cobra.Command{
 
 		err := util.InitLog(logLevel, "console")
 		if err != nil {
-			log.Errorf("failed initializing log %v", err)
-			return err
+			return fmt.Errorf("failed initializing log %v", err)
 		}
 
 		ctx := internal.CtxInitState(context.Background())
 
 		conn, err := DialClientGRPCServer(ctx, daemonAddr)
 		if err != nil {
-			log.Errorf("failed to connect to service CLI interface %v", err)
-			return err
+			return fmt.Errorf("failed to connect to daemon error: %v\n"+
+				"If the daemon is not running please run: "+
+				"\nnetbird service install \nnetbird service start\n", err)
 		}
 		defer conn.Close()
 
 		resp, err := proto.NewDaemonServiceClient(conn).Status(cmd.Context(), &proto.StatusRequest{})
 		if err != nil {
-			log.Errorf("status failed: %v", status.Convert(err).Message())
-			return nil
+			return fmt.Errorf("status failed: %v", status.Convert(err).Message())
+		}
+
+		if resp.GetStatus() == string(internal.StatusNeedsLogin) || resp.GetStatus() == string(internal.StatusLoginFailed) {
+			// todo: update login doc url
+			cmd.Printf("run the command \"netbird up\" to login. If no SSO provider has been set " +
+				"in your management server" +
+				"you can use a setup-key, " +
+				"see more at https://www.netbird.io/docs/overview/setup-keys for more info")
 		}
 
-		log.Infof("status: %v", resp.Status)
 		return nil
 	},
 }

client/cmd/up.go

@@ -2,13 +2,13 @@ package cmd
 
 import (
 	"context"
-
-	"github.com/netbirdio/netbird/util"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-
+	"fmt"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 )
 
 var upCmd = &cobra.Command{
@@ -17,10 +17,9 @@ var upCmd = &cobra.Command{
 	RunE: func(cmd *cobra.Command, args []string) error {
 		SetFlagsFromEnvVars()
 
-		err := util.InitLog(logLevel, logFile)
+		err := util.InitLog(logLevel, "console")
 		if err != nil {
-			log.Errorf("failed initializing log %v", err)
-			return err
+			return fmt.Errorf("failed initializing log %v", err)
 		}
 
 		ctx := internal.CtxInitState(cmd.Context())
@@ -29,15 +28,12 @@ var upCmd = &cobra.Command{
 		if logFile == "console" {
 			config, err := internal.GetConfig(managementURL, adminURL, configPath, preSharedKey)
 			if err != nil {
-				log.Errorf("get config file: %v", err)
-				return err
+				return fmt.Errorf("get config file: %v", err)
 			}
-			err = WithBackOff(func() error {
-				return internal.Login(ctx, config, setupKey, jwtToken)
-			})
+
+			err = foregroundLogin(ctx, cmd, config, setupKey)
 			if err != nil {
-				log.Errorf("backoff cycle failed: %v", err)
-				return err
+				return fmt.Errorf("foreground login failed: %v", err)
 			}
 
 			var cancel context.CancelFunc
@@ -48,43 +44,67 @@ var upCmd = &cobra.Command{
 
 		conn, err := DialClientGRPCServer(ctx, daemonAddr)
 		if err != nil {
-			log.Errorf("failed to connect to service CLI interface %v", err)
-			return err
+			return fmt.Errorf("failed to connect to daemon error: %v\n"+
+				"If the daemon is not running please run: "+
+				"\nnetbird service install \nnetbird service start\n", err)
 		}
 		defer conn.Close()
 
-		daemonClient := proto.NewDaemonServiceClient(conn)
+		client := proto.NewDaemonServiceClient(conn)
 
-		loginRequest := proto.LoginRequest{
-			SetupKey:      setupKey,
-			PreSharedKey:  preSharedKey,
-			ManagementUrl: managementURL,
-		}
-		err = WithBackOff(func() error {
-			_, err := daemonClient.Login(ctx, &loginRequest)
-			return err
-		})
+		status, err := client.Status(ctx, &proto.StatusRequest{})
 		if err != nil {
-			log.Errorf("backoff cycle failed: %v", err)
-			return err
+			return fmt.Errorf("unable to get daemon status: %v", err)
 		}
 
-		status, err := daemonClient.Status(ctx, &proto.StatusRequest{})
-		if err != nil {
-			log.Errorf("get status: %v", err)
-			return err
-		}
+		if status.Status == string(internal.StatusNeedsLogin) || status.Status == string(internal.StatusLoginFailed) {
+			loginRequest := proto.LoginRequest{
+				SetupKey:      setupKey,
+				PreSharedKey:  preSharedKey,
+				ManagementUrl: managementURL,
+			}
 
-		if status.Status != string(internal.StatusIdle) {
-			log.Warnf("already connected")
+			var loginErr error
+
+			var loginResp *proto.LoginResponse
+
+			err = WithBackOff(func() error {
+				var backOffErr error
+				loginResp, backOffErr = client.Login(ctx, &loginRequest)
+				if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
+					s.Code() == codes.PermissionDenied ||
+					s.Code() == codes.NotFound ||
+					s.Code() == codes.Unimplemented) {
+					loginErr = backOffErr
+					return nil
+				}
+				return backOffErr
+			})
+			if err != nil {
+				return fmt.Errorf("login backoff cycle failed: %v", err)
+			}
+
+			if loginErr != nil {
+				return fmt.Errorf("login failed: %v", loginErr)
+			}
+
+			if loginResp.NeedsSSOLogin {
+				openURL(cmd, loginResp.VerificationURI, loginResp.VerificationURIComplete, loginResp.UserCode)
+
+				_, err = client.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{UserCode: loginResp.UserCode})
+				if err != nil {
+					return fmt.Errorf("waiting sso login failed with: %v", err)
+				}
+			}
+		} else if status.Status != string(internal.StatusIdle) {
+			cmd.Println("Already connected")
 			return nil
 		}
 
-		if _, err := daemonClient.Up(ctx, &proto.UpRequest{}); err != nil {
-			log.Errorf("call service up method: %v", err)
-			return err
+		if _, err := client.Up(ctx, &proto.UpRequest{}); err != nil {
+			return fmt.Errorf("call service up method: %v", err)
 		}
-
+		cmd.Println("Connected")
 		return nil
 	},
 }