Weblogin with PKCS#11/OpenSC

[jan-kantert]

The new weblogin uses PyQt QtWebEngine which currently does not work with Smartcards. This seems to be a limition of QtWebEngine.

How do you feel about adding webdriver as an alternative option? That would allow login via a native Chrome/Firefox/Edge/whatever. Integration would not be as smooth (separate window) but it would enable every imaginable login.

[jan-kantert]

This would be a minimal example which works:

from selenium import webdriver
import time


def login():
    driver = webdriver.Firefox()
    driver.get("https://your_url.local/")
    print("Please login")

    # this part needs to be plugged into a pyqt event handler which calls itself
    while True:
        time.sleep(1)
        print(driver.get_cookies())


if __name__ == "__main__":
    login()

[HenriWahl]

Hi @jan-kantert - even without smartcard support this feature is an improvement compared to previous versions. The selenium approach looks rather fiddly and fits better into a developer setup. For a desktop application like Nagstamon, a more stable solution like PyQt QWebEngine is more suitable. Problems even begin when searching for selenium packages in any of the supported Linux distributions.
Maybe you would get PyQt working with smartcards when investigating its environment variable arguments like in https://stackoverflow.com/a/79729776?

[jan-kantert]

even without smartcard support this feature is an improvement compared to previous versions.

agreed. The issue in our setup is that you have to relogin every day with a rather long password unless you use your PKI card. In the current approach I cannot save my password so its really tedious.

In my PR both would work: 1. Store password in the browser (as it uses your main browser) 2. Use PKI if you got it set up in your browser. Unfortunately, its less generic than a pure browser login and requires some additional config on the server side.

The selenium approach looks rather fiddly and fits better into a developer setup. For a desktop application like Nagstamon, a more stable solution like PyQt QWebEngine is more suitable. Problems even begin when searching for selenium packages in any of the supported Linux distributions.

Selenium is available via pip as selenium. This installs the python extension and on first browser start it will install you the selenium extension for Chrome/Firefox. Its also heavily used in all kind of test automations and generally quite stable. Code is also super simple.

Maybe you would get PyQt working with smartcards when investigating its environment variable arguments like in https://stackoverflow.com/a/79729776?

I tried that. There are open issues in PyQt regarding any kind of additional auth modules. This is simply not supported at the moment.

[HenriWahl]

@jan-kantert yes, selenium works well in dev and automation environments. I see the problem for desktop deployment, especially in Linux, which is where Nagstamon comes from (and which I use too). Yes, it can be installed with pip, but not via package managers.
Maybe it would work via flatpak but this is rather fiddly too - see flathub/de.nagstamon.nagstamon#8 (comment), I don't even get a flatpak updated.
How did you use Nagstamon without web login?

[jan-kantert]

How did you use Nagstamon without web login?

We configured our loadbalancer in front of Icinga to skip oauth and use basic auth when the useragent was Nagstamon. That is why the user agent change broke it for my collegues (see #1160). Works but it does not scale well when on/offboarding users.

I guess one alternative would be to use some kind of CLI credentials helper. For instance awscli supports that and we got one to support OAuth for AWS that way. The helper just returns json with the credentials. Could be all required cookies + expiration in this case. This would allow us to either use selenium or an explicit device flow (as we do with AWS). The explicit device flow works by opening a page (in the normal browser with SSO) and then redirects for a localhost endpoint.

[HenriWahl]

@jan-kantert nice idea using the user agent at the loadbalancer 👍️