Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SNOW-1825621 OAuth code flow PKCE support #2137

Open
wants to merge 2 commits into
base: mkeller/SNOW-1825621/oauth-code-flow-support
Choose a base branch
from

Conversation

sfc-gh-mkeller
Copy link
Collaborator

@sfc-gh-mkeller sfc-gh-mkeller commented Jan 16, 2025

Please answer these questions before submitting your pull requests. Thanks!

  1. What GitHub issue is this PR addressing? Make sure that there is an accompanying issue to your PR.

    Fixes SNOW-1825621

  2. Fill out the following pre-review checklist:

    • I am adding a new automated test(s) to verify correctness of my new code
    • I am adding new logging messages
    • I am adding a new telemetry message
    • I am modifying authorization mechanisms
    • I am adding new credentials
    • I am modifying OCSP code
    • I am adding a new dependency
  3. Please describe how your code solves the related issue.

This PR builds on top of #2135 and it adds PKCE support on top of OAuth code flow.
This change has been tested manually, as it's fairly complicated to setup and we don't do unit tests for the different authentication methods.

  1. (Optional) PR for stored-proc connector:

@sfc-gh-mkeller sfc-gh-mkeller changed the title SNOW-1825621 OAuth PKCE support SNOW-1825621 OAuth code flow PKCE support Jan 16, 2025
@sfc-gh-mkeller sfc-gh-mkeller force-pushed the mkeller/SNOW-1825621/pkce-support branch from dc687f4 to 3684460 Compare January 16, 2025 19:24
@sfc-gh-mkeller sfc-gh-mkeller added the DO_NOT_PORT_CHANGES_TO_SP Add this label when changes in this PR do not need to be port to SP connector label Jan 16, 2025
@sfc-gh-mkeller sfc-gh-mkeller self-assigned this Jan 16, 2025
Copy link
Contributor

@sfc-gh-eworoshow sfc-gh-eworoshow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried to take a quick look at only the PKCE changes...

src/snowflake/connector/auth/oauth_code.py Outdated Show resolved Hide resolved
hashlib.sha256(self._verifier.encode("utf-8")).digest()
)
.decode("utf-8")
.replace("=", "")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if it's URL-safe it shouldn't have any padding?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

from https://docs.python.org/3/library/base64.html#base64.urlsafe_b64encode

The result can still contain =.

Unfortunately this remains necessary

@sfc-gh-mkeller sfc-gh-mkeller force-pushed the mkeller/SNOW-1825621/pkce-support branch from 4591ea1 to 6ae67ca Compare January 30, 2025 18:27
@sfc-gh-mkeller sfc-gh-mkeller force-pushed the mkeller/SNOW-1825621/pkce-support branch from 6ae67ca to 81627af Compare January 30, 2025 18:31
Copy link
Contributor

@sfc-gh-eworoshow sfc-gh-eworoshow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks reasonable to me but I'd prefer to stamp after we see a "clean" diff with the preceding work merged first.

@sfc-gh-mkeller sfc-gh-mkeller changed the base branch from main to mkeller/SNOW-1825621/oauth-code-flow-support January 31, 2025 17:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
DO_NOT_PORT_CHANGES_TO_SP Add this label when changes in this PR do not need to be port to SP connector
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants