support old and new concourse auth (< and >= 6.1.0?)

[jaredstehler]

Upgrading Concourse to 6.1.0 has broken authentication with Spinnaker, which uses the /sky/token endpoint: https://github.com/spinnaker/igor/blob/master/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/TokenService.java#L24-L32

  private Token refreshToken() {
    token =
        tokenService.passwordToken(
            "password", user, password, "openid profile email federated:id groups");
    tokenExpiration = token.getExpiry();
    return token;
  }

error is:

2020-05-23 19:16:31.265 ERROR 1 --- [RxIoScheduler-4] c.n.s.i.concourse.ConcourseBuildMonitor  : Failed to upda
te monitor items for monitor=ConcourseBuildMonitor:partition=wna-build

retrofit.RetrofitError: 404 Not Found
        at retrofit.RetrofitError.httpError(RetrofitError.java:40) ~[retrofit-1.9.0.jar:na]
        at retrofit.RestAdapter$RestHandler.invokeRequest(RestAdapter.java:388) ~[retrofit-1.9.0.jar:na]
        at retrofit.RestAdapter$RestHandler.invoke(RestAdapter.java:240) ~[retrofit-1.9.0.jar:na]
        at com.sun.proxy.$Proxy169.userInfo(Unknown Source) ~[na:na]
        at com.netflix.spinnaker.igor.concourse.service.ConcourseService.refreshTokenIfNecessary(ConcourseServi
ce.java:366) ~[igor-web.jar:na]

Is there documentation on the new method for authenticating? Also, would you recommend doing a version check via /api/v1/info and branching based on that result, or is there a better way of supporting old and new concourse versions from igor?

[jaredstehler]

I found I was able to get authentication working again in igor with the following hack:

index 1164e6b..b1b92c4 100644
--- a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/ConcourseClient.java
+++ b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/ConcourseClient.java
@@ -61,7 +61,7 @@ public class ConcourseClient {
         @Override
         public void intercept(RequestFacade request) {
           refreshTokenIfNecessary();
-          request.addHeader("Authorization", "bearer " + token.getAccessToken());
+          request.addHeader("Authorization", "bearer " + token.getIdToken());
         }
       };
 
@@ -101,16 +101,16 @@ public class ConcourseClient {
   }
 
   private void refreshTokenIfNecessary() {
-    if (tokenExpiration.isBefore(ZonedDateTime.now())) {
-      this.refreshToken();
-    }
+//    if (tokenExpiration.isBefore(ZonedDateTime.now())) {
+    this.refreshToken();
+//    }
   }
 
   private Token refreshToken() {
     token =
         tokenService.passwordToken(
             "password", user, password, "openid profile email federated:id groups");
-    tokenExpiration = token.getExpiry();
+//    tokenExpiration = token.getExpiry();
     return token;
   }
 
diff --git a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/OkHttpClientBuilder.java b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/OkHttpClientBuilder.java
index e406f97..65d2a15 100644
--- a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/OkHttpClientBuilder.java
+++ b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/OkHttpClientBuilder.java
@@ -119,7 +119,7 @@ public class OkHttpClientBuilder {
                               .request()
                               .newBuilder()
                               .header(
-                                  "Authorization", "bearer " + refreshToken.get().getAccessToken())
+                                  "Authorization", "bearer " + refreshToken.get().getIdToken())
                               .build());
                   lastResponse.set(response);
                 }
@@ -171,7 +171,7 @@ public class OkHttpClientBuilder {
                               .request()
                               .newBuilder()
                               .header(
-                                  "Authorization", "bearer " + refreshToken.get().getAccessToken())
+                                  "Authorization", "bearer " + refreshToken.get().getIdToken())
                               .build());
                   lastResponse.set(response);
                 }
diff --git a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/SkyService.java b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/SkyService.java
index a387762..adb0744 100644
--- a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/SkyService.java
+++ b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/SkyService.java
@@ -20,6 +20,6 @@ import retrofit.client.Response;
 import retrofit.http.GET;
 
 public interface SkyService {
-  @GET("/sky/userinfo")
+  @GET("/api/v1/user")
   Response userInfo();
 }
diff --git a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/TokenService.java b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/TokenService.java
index 7d41abe..7282c5d 100644
--- a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/TokenService.java
+++ b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/TokenService.java
@@ -23,7 +23,7 @@ import retrofit.http.POST;
 
 public interface TokenService {
   @FormUrlEncoded
-  @POST("/sky/token")
+  @POST("/sky/issuer/token")
   Token passwordToken(
       @Field("grant_type") String grantType,
       @Field("username") String username,
diff --git a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/model/Token.java b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/model/Token.java
index 5d9a58c..a86d394 100644
--- a/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/model/Token.java
+++ b/igor-web/src/main/java/com/netflix/spinnaker/igor/concourse/client/model/Token.java
@@ -21,6 +21,6 @@ import lombok.Data;
 
 @Data
 public class Token {
-  private String accessToken;
+  private String idToken;
   private ZonedDateTime expiry;
 }

I believe I can clean this up and add a check on version.

[vito]

It looks like this endpoint changed in 16f4c66

In our current state we don't have a publicly supported API, so it's possible this will change again. Sorry, but I think the best bet right now is to change behavior based on the Concourse version.