Configuring OAuth 2.0 for GitHub

To enable users to work with a remote Git repository that is hosted on GitHub:

Set up the GitHub OAuth App (OAuth 2.0).
Apply the GitHub OAuth App Secret.

Setting up the GitHub OAuth App

Set up a GitHub OAuth App using OAuth 2.0.

Prerequisites

You are logged in to GitHub.
base64 is installed in the operating system you are using.

Procedure

Go to https://github.com/settings/applications/new.
Enter the following values:
1. Application name: <application name>
2. Homepage URL: https://<che_fqdn>/
3. Authorization callback URL: https://<che_fqdn>/api/oauth/callback
Click Register application.
Click Generate new client secret.
Copy the GitHub OAuth Client ID and encode it to Base64 for use when applying the GitHub OAuth App Secret:
```
$ echo -n '<github_oauth_client_id>' | base64
```
Copy the GitHub OAuth Client Secret and encode it to Base64 for use when applying the GitHub OAuth App Secret:
```
$ echo -n '<github_oauth_client_secret>' | base64
```

Additional resources

GitHub Docs: Creating an OAuth App

Applying the GitHub OAuth App Secret

Prepare and apply the GitHub OAuth App Secret.

Prerequisites

Setting up the GitHub OAuth App is completed.
The Base64-encoded values, which were generated when setting up the GitHub OAuth App, are prepared:
- GitHub OAuth Client ID
- GitHub OAuth Client Secret
An active kubectl session with administrative permissions to the destination Kubernetes cluster. See Overview of kubectl.

Procedure

Prepare the Secret:

kind: Secret
apiVersion: v1
metadata:
  name: github-oauth-config
  namespace: eclipse-che (1)
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: oauth-scm-configuration
  annotations:
    che.eclipse.org/oauth-scm-server: github
    che.eclipse.org/scm-server-endpoint: <github_server_url> (2)
    che.eclipse.org/scm-github-disable-subdomain-isolation: "<true_or_false>" (3)
type: Opaque
data:
  id: <Base64_GitHub_OAuth_Client_ID> (4)
  secret: <Base64_GitHub_OAuth_Client_Secret> (5)

1	The Che namespace. The default is `eclipse-che`.
2	This depends on the GitHub product your organization is using: When hosting repositories on GitHub.com or GitHub Enterprise Cloud, omit this line or enter the default `https://github.com`. When hosting repositories on GitHub Enterprise Server, enter the GitHub Enterprise Server URL.
3	This line is only added for GitHub Enterprise Server. To disable subdomain isolation, set this to `"true"`. To enable subdomain isolation, set this to `"false"`.
4	The Base64-encoded GitHub OAuth Client ID.
5	The Base64-encoded GitHub OAuth Client Secret.

Apply the Secret:

$ kubectl apply -f - <<EOF
<Secret_prepared_in_the_previous_step>
EOF

Verify in the output that the Secret is created.

To configure OAuth 2.0 for another GitHub provider, you have to repeat the steps above and create a second GitHub OAuth Secret with a different name.