Eclispe Che Dashboard User Settings to Store SSH Keys or Personal Access Tokens for devfile checkout of Private Git Repositories.

[Mbd06b]

Is your enhancement related to a problem? Please describe

As a user, I am frustrated at the difficulty and confusion in documentation for configuring che 7 so that devfiles I (as an author) can checkout code and workspaces form my private repositories.

The configuring GitHub OAuth documentation is painful, because it requires direct configuration of a kubectl secret which introduces confusion over the mismatch between base64 encoded secrets, and the GitHub generated client id and secret strings.
https://www.eclipse.org/che/docs/che-7/administration-guide/configuring-authorization/#enabling-authentication-with-social-accounts-and-brokering_che

Lastly, documentation only refers to keycloak's configuration with Github, but it does not specify what options in the identity provider should be selected for Eclipse Che https://www.keycloak.org/docs/6.0//server_admin/#github

• Default Scopes?
• Store Tokens?
• Store Tokens Readable ?
• Enabled (assumed yes)
• Disable User Info ?
• Trust Email ?
• GUI Order ?
• First Login Flow? (assumed first broker login)
• Post Login Flow?
  Is there documentation out there that specifies? Not that I've found yet.

I also have understood OAuth to be a login feature, but currently don't understand how it might facilitate ssh_key connections to Github. Due to confusion wit the whole oAuth Authentication/Authorization spec itself I might even be barking up the wrong tree here and not even know it.

Describe the solution you'd like

Similarly to Azure Devops, Gitlab, or Github, I would like the ability to store personal access tokens, and ssh keys, to my che user account, in the User Account area of the Che Dashboard, so that devfiles I author can be checked out from private repositories when authoring workspaces.

So avoiding the configuration complexities by providing a similar UI solution.

If that's not an option,
I would like clarification in the documentation how the identity providers should be configured for Che in Keycloak.

And if that doesn't solve my issue,
I want some way of authoring devfiles and checkout code from a private repository, without having to perform in-editor ssh key configurations on every workspace.

Describe alternatives you've considered

Following the configuring Github Authorization. https://www.eclipse.org/che/docs/che-7/administration-guide/configuring-authorization/

I still had no success in the preferences of theia editor... I get this error message saying I need to set something up when trying to pull...

Additional context

Identity Provider Configuration in Keycloak, I have no idea if this is what is expected.

User Preferences could be used for User Configuartion of Github SSH_Keys, or Personal Access Tokens

(standard https connections are being deprecated)

currently on Che 7.28.2 (chectl 7.35.2)

[skabashnyuk]

@Mbd06b thank you for this report and sorry for that inconvenience. I/we would like to make documentation and product better in this area. To do so I need to know a bit more about your environment. Is this:

• k8s or OpenShift?
• How did you install Che? Helm or operator?
• What was the repo URL?
• Did you use factories?

[Mbd06b]

@Mbd06b thank you for this report and sorry for that inconvenience. I/we would like to make documentation and product better in this area. To do so I need to know a bit more about your environment. Is this:

• k8s or OpenShift?
  (k8s, specifically microk8s, I use nginix to proxy to kubernetes on a single host, you can get details on my configuration here. [solved] Deploy Che-multiuser behind Nginx proxy with https using only FQDN #14788)

• How did you install Che? Helm or operator?
  (I started with helm, but I think I've reinstalled recently with the operator, I maintain almost everything with the chectl)

• What was the repo URL?
  https://github.com/Mbd06b/matriculator (it's set to private, I added you as a collaborator, Here's the devfile https://raw.githubusercontent.com/Mbd06b/matriculator/main/.devfile?token=ADAQGBXLCTSHYGNXYUBJBMTBG55K4) . At the moment the project is just training to understand Spring Boot oAuth concepts in Spring Security.

• Did you use factories?
  (I just am taking a "getting started" template like the Spring Boot MySql starter that works and replacing the "project.name.source.location" with my private repository (https link) and removing the commitId. Side Question: can the SSH git link be used in the location? EX: "[email protected]:Mbd06b/matriculator.git" )

[skabashnyuk]

(I started with helm, but I think I've reinstalled recently with the operator, I maintain almost everything with the chectl)

I believe the helm is the answer to why the secret mentioned in this document https://www.eclipse.org/che/docs/che-7/administration-guide/configuring-authorization/#configuring-github-oauth_che didn't work for you. We forgot to add che-operator to the prerequisites. Document has to be updated.

(I just am taking a "getting started" template like the Spring Boot MySql starter that works and replacing the "project.name.source.location" with my private repository (https link) and removing the commitId.

It is hard for me to understand the desired behavior for your users. If I'm not mistaken at this point, only factories https://www.eclipse.org/che/docs/che-7/end-user-guide/creating-a-workspace-from-remote-devfile/ initiate an automated process to get Github tokens.

ide Question: can the SSH git link be used in the location? EX: "[email protected]:Mbd06b/matriculator.git" )

CC @vinokurig @svor Can you remind me the process with SSH.

[vinokurig]

@Mbd06b

ide Question: can the SSH git link be used in the location? EX: "[email protected]:Mbd06b/matriculator.git" )

Yes, it works in the same way as a usual HTTPS link in case an SSH key has been setup. See https://www.eclipse.org/che/docs/che-7/end-user-guide/version-control/#accessing-a-git-repository-via-ssh_che

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.