How `coder_external_auth` work ? #10451

glenn2wang · 2023-11-01T08:49:25Z

glenn2wang
Nov 1, 2023

when I use the coder_external_auth, it can auto Clone repo from GitHub when i create workspace or git clone in the terminal.
but in the IDE such like vscode or Jebrains IDEA , when I push or pull code, it still need username & password.

i do not know such thing missed by me, or sothing else

matifali · 2023-11-01T09:10:38Z

matifali
Nov 1, 2023
Maintainer

Hi @glenn2wang, you need to inject the GITHUB_TOKEN variable using either

Template: Access token from data.coder_external_auth.<NAME>.access_token using coder_agent env block
CLI: coder external-auth access-token <EXTERNAL_AUTH_ID>

It would benefit if we also explain this process in our docs.

0 replies

matifali · 2023-11-01T09:19:13Z

matifali
Nov 1, 2023
Maintainer

@kylecarbs to understand it better,
We have two ways for git authentication

If users add their Coder SSH public key to GitHub, they are automatically authenticated using GIT_ASKPASS in their workspaces. (This does not allow cloning private repos during workspace creation)
If there is EXTERNAL_AUTH configured, they need to inject GITHUB_TOKEN either by CLI or template's data.coder_external_auth.<NAME>.access_token.

What happens if both are configured? Which one takes the priority? Is there a way to prefer one over the other?

cc: @bpmct

3 replies

bpmct Nov 1, 2023
Maintainer

Hey @matifali - to clarify a few things:

The SSH key does not impact GIT_ASKPASS. It's simply a key injected into the workspace and only applies when someone tries to clone a repo over SSH
When a user clones over HTTPS, git askpass is used. You don't need to set GITHUB_TOKEN in this case as it uses GIT_ASK_PASS

matifali Nov 1, 2023
Maintainer

Thanks Ben. Could you verify my original answer above?

Emyrk Feb 12, 2024
Collaborator

@matifali I think GITHUB_TOKEN takes priority. The problem with GITHUB_TOKEN is they can expire. For Gitlab, tokens expire in 2hrs. So using GIT_ASKPASS is pretty much the only way to stay authed in a workspace.

glenn2wang · 2023-11-01T09:53:26Z

glenn2wang
Nov 1, 2023
Author

Is gitlab has token such like github_token ?

2 replies

glenn2wang Nov 9, 2023
Author

when i use http to clone
idea cannot use the GIT_ASK_PASS

matifali Jan 3, 2024
Maintainer

@glenn2wang This comment seems related to your question.

thelittlerocket · 2023-12-13T03:39:49Z

thelittlerocket
Dec 13, 2023

I have got a similar problem.
external_auth with gitea then create a workspace, can git clone and git push with either https:// or ssh:// in the terminal without problem, but in the IDE, it will always ask for username and password if using git clone https://.

here are the relevant configs from main.tf

data "coder_external_auth" "gitea" {
  # Matches the ID of the external auth provider in Coder.
  id = "gitea"
}

resource "coder_agent" "main" {
  arch                   = data.coder_provisioner.me.arch
  os                     = "linux"
  startup_script_timeout = 180
  startup_script         = <<-EOT
    set -e

    # install and start code-server
    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.11.0
    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &

  EOT

  # These environment variables allow you to make Git commits right away after creating a
  # workspace. Note that they take precedence over configuration defined in ~/.gitconfig!
  # You can remove this block if you'd prefer to configure Git manually or using
  # dotfiles. (see docs/dotfiles.md)
  env = {
    GIT_AUTHOR_NAME     = "${data.coder_workspace.me.owner}"
    GIT_COMMITTER_NAME  = "${data.coder_workspace.me.owner}"
    GIT_AUTHOR_EMAIL    = "${data.coder_workspace.me.owner_email}"
    GIT_COMMITTER_EMAIL = "${data.coder_workspace.me.owner_email}"
    GITHUB_TOKEN = "${data.coder_external_auth.github.access_token}"
  }

In the terminal, the GITHUB_TOKEN environment variable exists but is not in IDE's terminal, even if I manually export GITHUB_TOKEN in the IDE, it still asks for username/password when git clone https:// .

Any help would be appreciated, thanks,

10 replies

matifali Feb 7, 2024
Maintainer

@Emyrk @ericpaulsen if you have an idea.

ericpaulsen Feb 7, 2024
Collaborator

hi all - can you echo $GIT_ASKPASS and echo $GIT_SSH_COMMAND in the workspace?

How coder_external_auth work ? #10451

Uh oh!

Uh oh!

glenn2wang Nov 1, 2023

Replies: 4 comments · 15 replies

Uh oh!

Uh oh!

matifali Nov 1, 2023 Maintainer

Uh oh!

Uh oh!

matifali Nov 1, 2023 Maintainer

Uh oh!

bpmct Nov 1, 2023 Maintainer

Uh oh!

matifali Nov 1, 2023 Maintainer

Uh oh!

Emyrk Feb 12, 2024 Collaborator

Uh oh!

glenn2wang Nov 1, 2023 Author

Uh oh!

glenn2wang Nov 9, 2023 Author

Uh oh!

matifali Jan 3, 2024 Maintainer

Uh oh!

thelittlerocket Dec 13, 2023

Uh oh!

matifali Feb 7, 2024 Maintainer

Uh oh!

ericpaulsen Feb 7, 2024 Collaborator

Uh oh!

joshzarrabi-picnic Feb 8, 2024

Uh oh!

joshzarrabi-picnic Feb 8, 2024

Uh oh!

joshzarrabi-picnic Feb 8, 2024

How `coder_external_auth` work ? #10451

glenn2wang
Nov 1, 2023

Replies: 4 comments 15 replies

matifali
Nov 1, 2023
Maintainer

matifali
Nov 1, 2023
Maintainer

bpmct Nov 1, 2023
Maintainer

matifali Nov 1, 2023
Maintainer

Emyrk Feb 12, 2024
Collaborator

glenn2wang
Nov 1, 2023
Author

glenn2wang Nov 9, 2023
Author

matifali Jan 3, 2024
Maintainer

thelittlerocket
Dec 13, 2023

matifali Feb 7, 2024
Maintainer

ericpaulsen Feb 7, 2024
Collaborator