Skip to content

Introduce token authentication with OIDC token

Tan Le requested to merge 56-api-v3-with-jwt-auth into main

What does this MR do and why?

This MR adds a new authentication provider using the JWT token for v2/completions endpoint. This authentication method uses JWKs available via the OIDC configuration endpoint to verify the signature. The JWKs key is cached for 24 hours.

The new authentication methods are assigned in the MiddlewareAuthentication as follows:

  • VSCode (default): use OAuth/PAT token authentication
  • Web IDE (with X-Gitlab-Authentication-Type="oidc"): use JWT token authentication

Block highlighted in #e9967a is part of this MR.

Related to #56 (closed)

How to test locally

  1. Checkout this branch

  2. Get a JWT token by running the following command on this GitLab branch.

    jwt_token = Gitlab::CodeSuggestions::AccessToken.new.encoded
  3. Update the .env file in the root folder with the following variables.

    AUTH_BYPASS_EXTERNAL=false
    TRITON_HOST=localhost
    TRITON_PORT=8080
    FASTAPI_DOCS_URL=/docs
    FASTAPI_OPENAPI_URL=/openapi.json
    FASTAPI_API_PORT=5052
    GITLAB_URL="http://gdk.test:3000/"
    GITLAB_API_URL="http://gdk.test:3000/api/v4/"
  4. Build a local Docker image

    docker buildx build --platform linux/amd64 -t code-suggestions-api:dev .
  5. Run the local Docker image (can be replaced with Docker Compose).

    docker run --platform linux/amd64 --rm -p 5052:5052 -v $PWD:/app -it code-suggestions-api:dev
  6. Run a cURL command to check the authentication, using the jwt_token generated in Step 2.

    curl -vvv --request POST \
      --url http://localhost:5999/v2/completions \
      --header 'Content-Type: application/json' \
      --header 'X-Gitlab-Authentication-Type: oidc' \
      --header 'authorization: Bearer <jwt_token>' \
      --data '{
       "prompt_version": 1,
       "project_path": "awesome_project",
       "project_id": 23,
       "current_file": {
         "file_name": "main.py",
         "content_above_cursor": "\"\"\"\nImplement fastapi middleware to log all incoming requests\"\"\"\n",
         "content_below_cursor": "scoopy doo"
       }
    }'
  7. We should see a 500 response since the authentication has passed but the model gateway fails to call an unavailable Triton server.

Edited by Tan Le

Merge request reports