sentry icon indicating copy to clipboard operation
sentry copied to clipboard

chore(hybrid-cloud): Delegate pipeline redis store to propagate customer domain

Open dashed opened this issue 3 years ago • 0 comments

In https://github.com/getsentry/sentry/pull/38970, I had updated an OAuth2 provider implementation such that we do per-request customization by dynamically update the callback URL based on if a subdomain is present (e.g. sentry.sentry.io)

The OAuth2 spec on redirect URIs suggests that request-specific data in the callback URL be delegated to the "state" parameter.

I've undid the per-request callback URL changes added in https://github.com/getsentry/sentry/pull/38970, and instead delegated to the pipeline redis store (using "state" parameter) to propagate any customer domain information.

The request flow for customer domains should look like this:

  1. Go to https://orgslug.sentry.io
  2. Click on social media button: https://sentry.io/identity/login/google/?referrer=login
  3. Create unique state parameter and store orgslug customer domain in pipeline redis store.
  4. Redirect to https://accounts.google.com/o/oauth2/auth
  5. Perform OAuth2 authorization flow.
  6. Redirect back to https://sentry.io/auth/sso/
  7. Authorization code token exchange.
  8. Retrieve orgslug customer domain from pipeline redis store, and redirect user to https://orgslug.sentry.io/auth/login
  9. Redirect to https://orgslug.sentry.o/organizations/orgslug/issues/ (this will be an orgless slug in the future)

dashed avatar Sep 19 '22 18:09 dashed