implement identity provider and built-in oauth server

Signed-off-by: hongming <talonwan@yunify.com>
2020-03-26 06:43:20 +08:00
parent 59002cd176
commit 9b9d4021ec
25 changed files with 637 additions and 1163 deletions
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -12,31 +12,29 @@ import (
 	unionauth "k8s.io/apiserver/pkg/authentication/request/union"
 	"k8s.io/apiserver/pkg/endpoints/handlers/responsewriters"
 	"k8s.io/klog"
-	"kubesphere.io/kubesphere/pkg/api/auth"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/authenticators/basic"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/authenticators/jwttoken"
-	oauth2 "kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/request/anonymous"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/request/basictoken"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/token"
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizerfactory"
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/path"
 	unionauthorizer "kubesphere.io/kubesphere/pkg/apiserver/authorization/union"
+	apiserverconfig "kubesphere.io/kubesphere/pkg/apiserver/config"
 	"kubesphere.io/kubesphere/pkg/apiserver/dispatch"
 	"kubesphere.io/kubesphere/pkg/apiserver/filters"
 	"kubesphere.io/kubesphere/pkg/apiserver/request"
 	"kubesphere.io/kubesphere/pkg/informers"
-	devopsv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/devops/v1alpha2"
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/iam/v1alpha2"
 	loggingv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/logging/v1alpha2"
 	monitoringv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/monitoring/v1alpha2"
-	"kubesphere.io/kubesphere/pkg/kapis/oauth"
+	oauth "kubesphere.io/kubesphere/pkg/kapis/oauth"
 	openpitrixv1 "kubesphere.io/kubesphere/pkg/kapis/openpitrix/v1"
 	operationsv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/operations/v1alpha2"
 	resourcesv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/resources/v1alpha2"
 	resourcev1alpha3 "kubesphere.io/kubesphere/pkg/kapis/resources/v1alpha3"
+	"kubesphere.io/kubesphere/pkg/kapis/serverconfig"
 	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/servicemesh/metrics/v1alpha2"
-	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/tenant/v1alpha2"
 	terminalv1alpha2 "kubesphere.io/kubesphere/pkg/kapis/terminal/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/models/iam/am"
 	"kubesphere.io/kubesphere/pkg/models/iam/im"
@@ -75,7 +73,7 @@ type APIServer struct {
 	//
 	Server *http.Server

-	AuthenticateOptions *auth.AuthenticationOptions
+	Config *apiserverconfig.Config

 	// webservice container, where all webservice defines
 	container *restful.Container
@@ -135,19 +133,19 @@ func (s *APIServer) PrepareRun() error {
 }

 func (s *APIServer) installKubeSphereAPIs() {
-
+	urlruntime.Must(serverconfig.AddToContainer(s.container, s.Config))
 	urlruntime.Must(resourcev1alpha3.AddToContainer(s.container, s.InformerFactory))
 	// Need to refactor devops api registration, too much dependencies
-	urlruntime.Must(devopsv1alpha2.AddToContainer(s.container, s.DevopsClient, s.DBClient.Database(), nil, s.KubernetesClient.KubeSphere(), s.InformerFactory.KubeSphereSharedInformerFactory(), s.S3Client))
+	//urlruntime.Must(devopsv1alpha2.AddToContainer(s.container, s.DevopsClient, s.DBClient.Database(), nil, s.KubernetesClient.KubeSphere(), s.InformerFactory.KubeSphereSharedInformerFactory(), s.S3Client))
 	urlruntime.Must(loggingv1alpha2.AddToContainer(s.container, s.KubernetesClient, s.LoggingClient))
 	urlruntime.Must(monitoringv1alpha2.AddToContainer(s.container, s.KubernetesClient, s.MonitoringClient))
 	urlruntime.Must(openpitrixv1.AddToContainer(s.container, s.InformerFactory, s.OpenpitrixClient))
 	urlruntime.Must(operationsv1alpha2.AddToContainer(s.container, s.KubernetesClient.Kubernetes()))
 	urlruntime.Must(resourcesv1alpha2.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), s.InformerFactory))
-	urlruntime.Must(tenantv1alpha2.AddToContainer(s.container, s.KubernetesClient, s.InformerFactory, s.DBClient.Database()))
+	//urlruntime.Must(tenantv1alpha2.AddToContainer(s.container, s.KubernetesClient, s.InformerFactory, s.DBClient.Database()))
 	urlruntime.Must(terminalv1alpha2.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), s.KubernetesClient.Config()))
-	urlruntime.Must(iamv1alpha2.AddToContainer(s.container, s.KubernetesClient, s.InformerFactory, s.LdapClient, s.CacheClient, s.AuthenticateOptions))
-	urlruntime.Must(oauth.AddToContainer(s.container, token.NewJwtTokenIssuer(token.DefaultIssuerName, s.AuthenticateOptions, s.CacheClient), &oauth2.SimpleConfigManager{}))
+	urlruntime.Must(iamv1alpha2.AddToContainer(s.container, s.KubernetesClient, s.InformerFactory, s.LdapClient, s.CacheClient, s.Config.AuthenticationOptions))
+	urlruntime.Must(oauth.AddToContainer(s.container, token.NewJwtTokenIssuer(token.DefaultIssuerName, s.Config.AuthenticationOptions, s.CacheClient), s.Config.AuthenticationOptions))
 	urlruntime.Must(servicemeshv1alpha2.AddToContainer(s.container))
 }

@@ -187,7 +185,7 @@ func (s *APIServer) buildHandlerChain() {
 	handler = filters.WithKubeAPIServer(handler, s.KubernetesClient.Config(), &errorResponder{})
 	handler = filters.WithMultipleClusterDispatcher(handler, dispatch.DefaultClusterDispatch)

-	excludedPaths := []string{"/oauth/authorize", "/oauth/token"}
+	excludedPaths := []string{"/oauth/*", "/server/configs/*"}
 	pathAuthorizer, _ := path.NewAuthorizer(excludedPaths)
 	authorizer := unionauthorizer.New(pathAuthorizer,
 		authorizerfactory.NewOPAAuthorizer(am.NewFakeAMOperator()))
@@ -196,7 +194,7 @@ func (s *APIServer) buildHandlerChain() {
 	authn := unionauth.New(anonymous.NewAuthenticator(),
 		basictoken.New(basic.NewBasicAuthenticator(im.NewFakeOperator())),
 		bearertoken.New(jwttoken.NewTokenAuthenticator(
-			token.NewJwtTokenIssuer(token.DefaultIssuerName, s.AuthenticateOptions, s.CacheClient))))
+			token.NewJwtTokenIssuer(token.DefaultIssuerName, s.Config.AuthenticationOptions, s.CacheClient))))
 	handler = filters.WithAuthentication(handler, authn)
 	handler = filters.WithRequestInfo(handler, requestInfoResolver)
 	s.Server.Handler = handler
--- a/pkg/apiserver/authentication/authenticators/jwttoken/jwt_token.go
+++ b/pkg/apiserver/authentication/authenticators/jwttoken/jwt_token.go
@@ -23,7 +23,7 @@ func NewTokenAuthenticator(issuer token2.Issuer) authenticator.Token {
 }

 func (t *tokenAuthenticator) AuthenticateToken(ctx context.Context, token string) (*authenticator.Response, bool, error) {
-	providedUser, _, err := t.jwtTokenIssuer.Verify(token)
+	providedUser, err := t.jwtTokenIssuer.Verify(token)
 	if err != nil {
 		return nil, false, err
 	}
--- a/pkg/apiserver/authentication/identityprovider/identity_provider.go
+++ b/pkg/apiserver/authentication/identityprovider/identity_provider.go
@@ -16,15 +16,10 @@
 * /
 */

-package oauth
+package identityprovider

-import (
-	"errors"
-	"golang.org/x/oauth2"
-)
+import "k8s.io/apiserver/pkg/authentication/user"

-var ConfigNotFound = errors.New("config not found")
-
-type Configuration interface {
-	Load(clientId string) (*oauth2.Config, error)
+type OAuth2Interface interface {
+	IdentityExchange(code string) (user.Info, error)
 }
--- a/pkg/apiserver/authentication/oauth/github.go
+++ b/pkg/apiserver/authentication/oauth/github.go
@@ -0,0 +1,157 @@
+/*
+ *
+ * Copyright 2020 The KubeSphere Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package oauth
+
+import (
+	"context"
+	"encoding/json"
+	"golang.org/x/oauth2"
+	"io/ioutil"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"time"
+)
+
+const (
+	UserInfoURL = "https://api.github.com/user"
+)
+
+type Github struct {
+	// ClientID is the application's ID.
+	ClientID string `json:"clientID" yaml:"clientID"`
+
+	// ClientSecret is the application's secret.
+	ClientSecret string `json:"-" yaml:"clientSecret"`
+
+	// Endpoint contains the resource server's token endpoint
+	// URLs. These are constants specific to each server and are
+	// often available via site-specific packages, such as
+	// google.Endpoint or github.Endpoint.
+	Endpoint Endpoint `json:"endpoint" yaml:"endpoint"`
+
+	// RedirectURL is the URL to redirect users going through
+	// the OAuth flow, after the resource owner's URLs.
+	RedirectURL string `json:"redirectURL" yaml:"redirectURL"`
+
+	// Scope specifies optional requested permissions.
+	Scopes []string `json:"scopes" yaml:"scopes"`
+}
+
+// Endpoint represents an OAuth 2.0 provider's authorization and token
+// endpoint URLs.
+type Endpoint struct {
+	AuthURL  string `json:"authURL" yaml:"authURL"`
+	TokenURL string `json:"tokenURL" yaml:"tokenURL"`
+}
+
+type GithubIdentity struct {
+	Login             string    `json:"login"`
+	ID                string    `json:"id"`
+	NodeID            string    `json:"node_id"`
+	AvatarURL         string    `json:"avatar_url"`
+	GravatarID        string    `json:"gravatar_id"`
+	URL               string    `json:"url"`
+	HTMLURL           string    `json:"html_url"`
+	FollowersURL      string    `json:"followers_url"`
+	FollowingURL      string    `json:"following_url"`
+	GistsURL          string    `json:"gists_url"`
+	StarredURL        string    `json:"starred_url"`
+	SubscriptionsURL  string    `json:"subscriptions_url"`
+	OrganizationsURL  string    `json:"organizations_url"`
+	ReposURL          string    `json:"repos_url"`
+	EventsURL         string    `json:"events_url"`
+	ReceivedEventsURL string    `json:"received_events_url"`
+	Type              string    `json:"type"`
+	SiteAdmin         bool      `json:"site_admin"`
+	Name              string    `json:"name"`
+	Company           string    `json:"company"`
+	Blog              string    `json:"blog"`
+	Location          string    `json:"location"`
+	Email             string    `json:"email"`
+	Hireable          bool      `json:"hireable"`
+	Bio               string    `json:"bio"`
+	PublicRepos       int       `json:"public_repos"`
+	PublicGists       int       `json:"public_gists"`
+	Followers         int       `json:"followers"`
+	Following         int       `json:"following"`
+	CreatedAt         time.Time `json:"created_at"`
+	UpdatedAt         time.Time `json:"updated_at"`
+	PrivateGists      int       `json:"private_gists"`
+	TotalPrivateRepos int       `json:"total_private_repos"`
+	OwnedPrivateRepos int       `json:"owned_private_repos"`
+	DiskUsage         int       `json:"disk_usage"`
+	Collaborators     int       `json:"collaborators"`
+}
+
+func (g GithubIdentity) GetName() string {
+	return g.Login
+}
+
+func (g GithubIdentity) GetUID() string {
+	return g.ID
+}
+
+func (g GithubIdentity) GetGroups() []string {
+	return nil
+}
+
+func (g GithubIdentity) GetExtra() map[string][]string {
+	return nil
+}
+
+func (g *Github) IdentityExchange(code string) (user.Info, error) {
+	config := oauth2.Config{
+		ClientID:     g.ClientID,
+		ClientSecret: g.ClientSecret,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:   g.Endpoint.AuthURL,
+			TokenURL:  g.Endpoint.TokenURL,
+			AuthStyle: oauth2.AuthStyleAutoDetect,
+		},
+		RedirectURL: g.RedirectURL,
+		Scopes:      g.Scopes,
+	}
+	token, err := config.Exchange(context.Background(), code)
+
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := oauth2.NewClient(context.Background(), oauth2.StaticTokenSource(token)).Get(UserInfoURL)
+
+	if err != nil {
+		return nil, err
+	}
+
+	data, err := ioutil.ReadAll(resp.Body)
+	resp.Body.Close()
+
+	if err != nil {
+		return nil, err
+	}
+
+	var githubIdentity GithubIdentity
+
+	err = json.Unmarshal(data, &githubIdentity)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return githubIdentity, nil
+}
--- a/pkg/apiserver/authentication/oauth/oauth_options.go
+++ b/pkg/apiserver/authentication/oauth/oauth_options.go
@@ -0,0 +1,203 @@
+/*
+ *
+ * Copyright 2020 The KubeSphere Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package oauth
+
+import (
+	"errors"
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
+	"kubesphere.io/kubesphere/pkg/utils/sliceutil"
+)
+
+type GrantHandlerType string
+type MappingMethod string
+type IdentityProviderType string
+
+const (
+	// GrantHandlerAuto auto-approves client authorization grant requests
+	GrantHandlerAuto GrantHandlerType = "auto"
+	// GrantHandlerPrompt prompts the user to approve new client authorization grant requests
+	GrantHandlerPrompt GrantHandlerType = "prompt"
+	// GrantHandlerDeny auto-denies client authorization grant requests
+	GrantHandlerDeny GrantHandlerType = "deny"
+	// MappingMethodAuto  The default value.The user will automatically create and mapping when login successful.
+	// Fails if a user with that user name is already mapped to another identity.
+	MappingMethodAuto MappingMethod = "auto"
+	// MappingMethodLookup Looks up an existing identity, user identity mapping, and user, but does not automatically
+	// provision users or identities. Using this method requires you to manually provision users.
+	MappingMethodLookup MappingMethod = "lookup"
+	// MappingMethodMixed  A user entity can be mapped with multiple identifyProvider.
+	MappingMethodMixed MappingMethod = "mixed"
+
+	IdentityProviderTypeGithub = "github"
+)
+
+var (
+	ErrorClientNotFound           = errors.New("the OAuth client was not found")
+	ErrorRedirectURLNotAllowed    = errors.New("redirect URL is not allowed")
+	ErrorIdentityProviderNotFound = errors.New("the identity provider was not found")
+)
+
+type Options struct {
+	// LDAPPasswordIdentityProvider provider is used by default.
+	IdentityProviders []IdentityProvider `json:"identityProviders,omitempty" yaml:"identityProviders,omitempty"`
+
+	// Register additional OAuth clients.
+	Clients []Client `json:"clients,omitempty" yaml:"clients,omitempty"`
+
+	// AccessTokenMaxAgeSeconds  control the lifetime of access tokens. The default lifetime is 24 hours.
+	// 0 means no expiration.
+	AccessTokenMaxAgeSeconds int `json:"accessTokenMaxAgeSeconds" yaml:"accessTokenMaxAgeSeconds"`
+
+	// Inactivity timeout for tokens
+	// The value represents the maximum amount of time that can occur between
+	// consecutive uses of the token. Tokens become invalid if they are not
+	// used within this temporal window. The user will need to acquire a new
+	// token to regain access once a token times out.
+	// This value needs to be set only if the default set in configuration is
+	// not appropriate for this client. Valid values are:
+	// - 0: Tokens for this client never time out
+	// - X: Tokens time out if there is no activity for X seconds
+	// The current minimum allowed value for X is 300 (5 minutes)
+	AccessTokenInactivityTimeoutSeconds int `json:"accessTokenInactivityTimeoutSeconds" yaml:"accessTokenInactivityTimeoutSeconds"`
+}
+
+type IdentityProvider struct {
+	// The provider name.
+	Name string `json:"name" yaml:"name"`
+
+	// Defines how new identities are mapped to users when they login. Allowed values are:
+	//  - auto:   The default value.The user will automatically create and mapping when login successful.
+	//            Fails if a user with that user name is already mapped to another identity.
+	//  - lookup: Looks up an existing identity, user identity mapping, and user, but does not automatically
+	//            provision users or identities. Using this method requires you to manually provision users.
+	//  - mixed:  A user entity can be mapped with multiple identifyProvider.
+	MappingMethod MappingMethod `json:"mappingMethod" yaml:"mappingMethod"`
+
+	// When true, unauthenticated token requests from web clients (like the web console)
+	// are redirected to a login page (with WWW-Authenticate challenge header) backed by this provider.
+	LoginRedirect bool `json:"loginRedirect" yaml:"loginRedirect"`
+
+	// The type of identify provider
+	Type string `json:"type" yaml:"type"`
+
+	// Provider options
+	Github *Github `json:"github" yaml:"github" `
+}
+
+type Token struct {
+	// AccessToken is the token that authorizes and authenticates
+	// the requests.
+	AccessToken string `json:"access_token"`
+
+	// TokenType is the type of token.
+	// The Type method returns either this or "Bearer", the default.
+	TokenType string `json:"token_type,omitempty"`
+
+	// RefreshToken is a token that's used by the application
+	// (as opposed to the user) to refresh the access token
+	// if it expires.
+	RefreshToken string `json:"refresh_token,omitempty"`
+
+	// ExpiresIn is the optional expiration second of the access token.
+	ExpiresIn int `json:"expires_in,omitempty"`
+}
+
+type Client struct {
+	// The name of the OAuth client is used as the client_id parameter when making requests to <master>/oauth/authorize
+	// and <master>/oauth/token.
+	Name string
+
+	// Secret is the unique secret associated with a client
+	Secret string `json:"-" yaml:"secret,omitempty"`
+
+	// RespondWithChallenges indicates whether the client wants authentication needed responses made
+	// in the form of challenges instead of redirects
+	RespondWithChallenges bool `json:"respondWithChallenges,omitempty" yaml:"respondWithChallenges,omitempty"`
+
+	// RedirectURIs is the valid redirection URIs associated with a client
+	RedirectURIs []string `json:"redirectURIs,omitempty" yaml:"redirectURIs,omitempty"`
+
+	// GrantMethod determines how to handle grants for this client. If no method is provided, the
+	// cluster default grant handling method will be used. Valid grant handling methods are:
+	//  - auto:   always approves grant requests, useful for trusted clients
+	//  - prompt: prompts the end user for approval of grant requests, useful for third-party clients
+	//  - deny:   always denies grant requests, useful for black-listed clients
+	GrantMethod GrantHandlerType `json:"grantMethod,omitempty" yaml:"grantMethod,omitempty"`
+
+	// ScopeRestrictions describes which scopes this client can request.  Each requested scope
+	// is checked against each restriction.  If any restriction matches, then the scope is allowed.
+	// If no restriction matches, then the scope is denied.
+	ScopeRestrictions []string `json:"scopeRestrictions,omitempty" yaml:"scopeRestrictions,omitempty"`
+
+	// AccessTokenMaxAgeSeconds overrides the default access token max age for tokens granted to this client.
+	AccessTokenMaxAgeSeconds *int `json:"accessTokenMaxAgeSeconds,omitempty" yaml:"accessTokenMaxAgeSeconds,omitempty"`
+
+	// AccessTokenInactivityTimeoutSeconds overrides the default token
+	// inactivity timeout for tokens granted to this client.
+	AccessTokenInactivityTimeoutSeconds *int `json:"accessTokenInactivityTimeoutSeconds,omitempty" yaml:"accessTokenInactivityTimeoutSeconds,omitempty"`
+}
+
+func (o *Options) GetOAuthClient(name string) (Client, error) {
+	for _, found := range o.Clients {
+		if found.Name == name {
+			return found, nil
+		}
+	}
+	return Client{}, ErrorClientNotFound
+}
+func (o *Options) GetIdentityProvider(name string) (IdentityProvider, error) {
+	for _, found := range o.IdentityProviders {
+		if found.Name == name {
+			return found, nil
+		}
+	}
+	return IdentityProvider{}, ErrorClientNotFound
+}
+
+func (c Client) ResolveRedirectURL(expectURL string) (string, error) {
+	if len(c.RedirectURIs) == 0 {
+		return "", ErrorRedirectURLNotAllowed
+	}
+	if expectURL == "" {
+		return c.RedirectURIs[0], nil
+	}
+	if sliceutil.HasString(c.RedirectURIs, expectURL) {
+		return expectURL, nil
+	}
+	return "", ErrorRedirectURLNotAllowed
+}
+
+func (i IdentityProvider) GetOAuth2IdentityProviderInstance() (identityprovider.OAuth2Interface, error) {
+	switch i.Type {
+	case IdentityProviderTypeGithub:
+		if i.Github != nil {
+			return i.Github, nil
+		}
+	}
+	return nil, ErrorIdentityProviderNotFound
+}
+
+func NewOptions() *Options {
+	return &Options{
+		IdentityProviders:                   make([]IdentityProvider, 0),
+		Clients:                             make([]Client, 0),
+		AccessTokenMaxAgeSeconds:            86400,
+		AccessTokenInactivityTimeoutSeconds: 0,
+	}
+}
--- a/pkg/apiserver/authentication/oauth/simple_config.go
+++ b/pkg/apiserver/authentication/oauth/simple_config.go
@@ -1,37 +0,0 @@
-/*
- *
- * Copyright 2020 The KubeSphere Authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * /
- */
-
-package oauth
-
-import "golang.org/x/oauth2"
-
-type SimpleConfigManager struct {
-}
-
-func (s *SimpleConfigManager) Load(clientId string) (*oauth2.Config, error) {
-	if clientId == "kubesphere-console-client" {
-		return &oauth2.Config{
-			ClientID:     "8b21fef43889a28f2bd6",
-			ClientSecret: "xb21fef43889a28f2bd6",
-			Endpoint:     oauth2.Endpoint{AuthURL: "http://ks-apiserver.kubesphere-system.svc/oauth/authorize", TokenURL: "http://ks-apiserver.kubesphere.io/oauth/token"},
-			RedirectURL:  "http://ks-console.kubesphere-system.svc/oauth/token/implicit",
-			Scopes:       nil,
-		}, nil
-	}
-	return nil, ConfigNotFound
-}
--- a/pkg/apiserver/authentication/options/authenticate_options.go
+++ b/pkg/apiserver/authentication/options/authenticate_options.go
@@ -0,0 +1,72 @@
+/*
+ *
+ * Copyright 2020 The KubeSphere Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package options
+
+import (
+	"fmt"
+	"github.com/spf13/pflag"
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
+	"time"
+)
+
+type AuthenticationOptions struct {
+	// authenticate rate limit will
+	AuthenticateRateLimiterMaxTries int           `json:"authenticateRateLimiterMaxTries" yaml:"authenticateRateLimiterMaxTries"`
+	AuthenticateRateLimiterDuration time.Duration `json:"authenticationRateLimiterDuration" yaml:"authenticationRateLimiterDuration"`
+
+	// maximum retries when authenticate failed
+	MaxAuthenticateRetries int `json:"maxAuthenticateRetries" yaml:"maxAuthenticateRetries"`
+
+	// allow multiple users login at the same time
+	MultipleLogin bool `json:"multipleLogin" yaml:"multipleLogin"`
+
+	// secret to signed jwt token
+	JwtSecret string `json:"-" yaml:"jwtSecret"`
+
+	OAuthOptions *oauth.Options `json:"oauthOptions" yaml:"oauthOptions"`
+}
+
+func NewAuthenticateOptions() *AuthenticationOptions {
+	return &AuthenticationOptions{
+		AuthenticateRateLimiterMaxTries: 5,
+		AuthenticateRateLimiterDuration: time.Minute * 30,
+		MaxAuthenticateRetries:          0,
+		OAuthOptions:                    oauth.NewOptions(),
+		MultipleLogin:                   false,
+		JwtSecret:                       "",
+	}
+}
+
+func (options *AuthenticationOptions) Validate() []error {
+	var errs []error
+
+	if len(options.JwtSecret) == 0 {
+		errs = append(errs, fmt.Errorf("jwt secret is empty"))
+	}
+
+	return errs
+}
+
+func (options *AuthenticationOptions) AddFlags(fs *pflag.FlagSet, s *AuthenticationOptions) {
+	fs.IntVar(&options.AuthenticateRateLimiterMaxTries, "authenticate-rate-limiter-max-retries", s.AuthenticateRateLimiterMaxTries, "")
+	fs.DurationVar(&options.AuthenticateRateLimiterDuration, "authenticate-rate-limiter-duration", s.AuthenticateRateLimiterDuration, "")
+	fs.IntVar(&options.MaxAuthenticateRetries, "authenticate-max-retries", s.MaxAuthenticateRetries, "")
+	fs.BoolVar(&options.MultipleLogin, "multiple-login", s.MultipleLogin, "Allow multiple login with the same account, disable means only one user can login at the same time.")
+	fs.StringVar(&options.JwtSecret, "jwt-secret", s.JwtSecret, "Secret to sign jwt token, must not be empty.")
+}
--- a/pkg/apiserver/authentication/token/issuer.go
+++ b/pkg/apiserver/authentication/token/issuer.go
@@ -21,10 +21,10 @@ package token
 // Issuer issues token to user, tokens are required to perform mutating requests to resources
 type Issuer interface {
 	// IssueTo issues a token a User, return error if issuing process failed
-	IssueTo(User) (string, *Claims, error)
+	IssueTo(user User, expiresInSecond int) (string, error)

 	// Verify verifies a token, and return a User if it's a valid token, otherwise return error
-	Verify(string) (User, *Claims, error)
+	Verify(string) (User, error)

 	// Revoke a token,
 	Revoke(token string) error
--- a/pkg/apiserver/authentication/token/jwt.go
+++ b/pkg/apiserver/authentication/token/jwt.go
@@ -21,8 +21,8 @@ package token
 import (
 	"fmt"
 	"github.com/dgrijalva/jwt-go"
-	"kubesphere.io/kubesphere/pkg/api/auth"
 	"kubesphere.io/kubesphere/pkg/api/iam"
+	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/server/errors"
 	"kubesphere.io/kubesphere/pkg/simple/client/cache"
 	"time"
@@ -44,35 +44,35 @@ type Claims struct {

 type jwtTokenIssuer struct {
 	name    string
-	options *auth.AuthenticationOptions
+	options *authoptions.AuthenticationOptions
 	cache   cache.Interface
 	keyFunc jwt.Keyfunc
 }

-func (s *jwtTokenIssuer) Verify(tokenString string) (User, *Claims, error) {
+func (s *jwtTokenIssuer) Verify(tokenString string) (User, error) {
 	if len(tokenString) == 0 {
-		return nil, nil, errInvalidToken
+		return nil, errInvalidToken
 	}
 	_, err := s.cache.Get(tokenCacheKey(tokenString))

 	if err != nil {
 		if err == cache.ErrNoSuchKey {
-			return nil, nil, errTokenExpired
+			return nil, errTokenExpired
 		}
-		return nil, nil, err
+		return nil, err
 	}

 	clm := &Claims{}

 	_, err = jwt.ParseWithClaims(tokenString, clm, s.keyFunc)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}

-	return &iam.User{Name: clm.Username, UID: clm.UID}, clm, nil
+	return &iam.User{Name: clm.Username, UID: clm.UID}, nil
 }

-func (s *jwtTokenIssuer) IssueTo(user User) (string, *Claims, error) {
+func (s *jwtTokenIssuer) IssueTo(user User, expiresInSecond int) (string, error) {
 	clm := &Claims{
 		Username: user.GetName(),
 		UID:      user.GetUID(),
@@ -83,8 +83,8 @@ func (s *jwtTokenIssuer) IssueTo(user User) (string, *Claims, error) {
 		},
 	}

-	if s.options.TokenExpiration > 0 {
-		clm.ExpiresAt = clm.IssuedAt + int64(s.options.TokenExpiration.Seconds())
+	if expiresInSecond > 0 {
+		clm.ExpiresAt = clm.IssuedAt + int64(expiresInSecond)
 	}

 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, clm)
@@ -92,19 +92,19 @@ func (s *jwtTokenIssuer) IssueTo(user User) (string, *Claims, error) {
 	tokenString, err := token.SignedString([]byte(s.options.JwtSecret))

 	if err != nil {
-		return "", nil, err
+		return "", err
 	}

-	s.cache.Set(tokenCacheKey(tokenString), tokenString, s.options.TokenExpiration)
+	s.cache.Set(tokenCacheKey(tokenString), tokenString, time.Second*time.Duration(expiresInSecond))

-	return tokenString, clm, nil
+	return tokenString, nil
 }

 func (s *jwtTokenIssuer) Revoke(token string) error {
 	return s.cache.Del(tokenCacheKey(token))
 }

-func NewJwtTokenIssuer(issuerName string, options *auth.AuthenticationOptions, cache cache.Interface) Issuer {
+func NewJwtTokenIssuer(issuerName string, options *authoptions.AuthenticationOptions, cache cache.Interface) Issuer {
 	return &jwtTokenIssuer{
 		name:    issuerName,
 		options: options,
--- a/pkg/apiserver/authentication/token/jwt_test.go
+++ b/pkg/apiserver/authentication/token/jwt_test.go
@@ -20,14 +20,14 @@ package token

 import (
 	"github.com/google/go-cmp/cmp"
-	"kubesphere.io/kubesphere/pkg/api/auth"
 	"kubesphere.io/kubesphere/pkg/api/iam"
+	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/simple/client/cache"
 	"testing"
 )

 func TestJwtTokenIssuer(t *testing.T) {
-	options := auth.NewAuthenticateOptions()
+	options := authoptions.NewAuthenticateOptions()
 	options.JwtSecret = "kubesphere"
 	issuer := NewJwtTokenIssuer(DefaultIssuerName, options, cache.NewSimpleCache())

@@ -54,12 +54,12 @@ func TestJwtTokenIssuer(t *testing.T) {
 		}

 		t.Run(testCase.description, func(t *testing.T) {
-			token, _, err := issuer.IssueTo(user)
+			token, err := issuer.IssueTo(user, 0)
 			if err != nil {
 				t.Fatal(err)
 			}

-			got, _, err := issuer.Verify(token)
+			got, err := issuer.Verify(token)
 			if err != nil {
 				t.Fatal(err)
 			}
--- a/pkg/apiserver/config/config.go
+++ b/pkg/apiserver/config/config.go
@@ -5,13 +5,12 @@ import (
 	"github.com/emicklei/go-restful"
 	"github.com/spf13/viper"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"kubesphere.io/kubesphere/pkg/api/auth"
+	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
 	"kubesphere.io/kubesphere/pkg/simple/client/alerting"
 	"kubesphere.io/kubesphere/pkg/simple/client/cache"
 	"kubesphere.io/kubesphere/pkg/simple/client/devops/jenkins"
 	"kubesphere.io/kubesphere/pkg/simple/client/k8s"
-	"kubesphere.io/kubesphere/pkg/simple/client/kubesphere"
 	"kubesphere.io/kubesphere/pkg/simple/client/ldap"
 	"kubesphere.io/kubesphere/pkg/simple/client/logging/elasticsearch"
 	"kubesphere.io/kubesphere/pkg/simple/client/monitoring/prometheus"
@@ -63,23 +62,18 @@ const (

 // Config defines everything needed for apiserver to deal with external services
 type Config struct {
-	MySQLOptions       *mysql.Options         `json:"mysql,omitempty" yaml:"mysql,omitempty" mapstructure:"mysql"`
-	DevopsOptions      *jenkins.Options       `json:"devops,omitempty" yaml:"devops,omitempty" mapstructure:"devops"`
-	SonarQubeOptions   *sonarqube.Options     `json:"sonarqube,omitempty" yaml:"sonarQube,omitempty" mapstructure:"sonarqube"`
-	KubernetesOptions  *k8s.KubernetesOptions `json:"kubernetes,omitempty" yaml:"kubernetes,omitempty" mapstructure:"kubernetes"`
-	ServiceMeshOptions *servicemesh.Options   `json:"servicemesh,omitempty" yaml:"servicemesh,omitempty" mapstructure:"servicemesh"`
-	LdapOptions        *ldap.Options          `json:"ldap,omitempty" yaml:"ldap,omitempty" mapstructure:"ldap"`
-	RedisOptions       *cache.Options         `json:"redis,omitempty" yaml:"redis,omitempty" mapstructure:"redis"`
-	S3Options          *s3.Options            `json:"s3,omitempty" yaml:"s3,omitempty" mapstructure:"s3"`
-	OpenPitrixOptions  *openpitrix.Options    `json:"openpitrix,omitempty" yaml:"openpitrix,omitempty" mapstructure:"openpitrix"`
-	MonitoringOptions  *prometheus.Options    `json:"monitoring,omitempty" yaml:"monitoring,omitempty" mapstructure:"monitoring"`
-	LoggingOptions     *elasticsearch.Options `json:"logging,omitempty" yaml:"logging,omitempty" mapstructure:"logging"`
-
-	// Options below are only loaded from configuration file, no command line flags for these options now.
-	KubeSphereOptions *kubesphere.Options `json:"-" yaml:"kubesphere,omitempty" mapstructure:"kubesphere"`
-
-	AuthenticateOptions *auth.AuthenticationOptions `json:"authentication,omitempty" yaml:"authenticate,omitempty" mapstructure:"authenticate"`
-
+	MySQLOptions          *mysql.Options                     `json:"mysql,omitempty" yaml:"mysql,omitempty" mapstructure:"mysql"`
+	DevopsOptions         *jenkins.Options                   `json:"devops,omitempty" yaml:"devops,omitempty" mapstructure:"devops"`
+	SonarQubeOptions      *sonarqube.Options                 `json:"sonarqube,omitempty" yaml:"sonarQube,omitempty" mapstructure:"sonarqube"`
+	KubernetesOptions     *k8s.KubernetesOptions             `json:"kubernetes,omitempty" yaml:"kubernetes,omitempty" mapstructure:"kubernetes"`
+	ServiceMeshOptions    *servicemesh.Options               `json:"servicemesh,omitempty" yaml:"servicemesh,omitempty" mapstructure:"servicemesh"`
+	LdapOptions           *ldap.Options                      `json:"ldap,omitempty" yaml:"ldap,omitempty" mapstructure:"ldap"`
+	RedisOptions          *cache.Options                     `json:"redis,omitempty" yaml:"redis,omitempty" mapstructure:"redis"`
+	S3Options             *s3.Options                        `json:"s3,omitempty" yaml:"s3,omitempty" mapstructure:"s3"`
+	OpenPitrixOptions     *openpitrix.Options                `json:"openpitrix,omitempty" yaml:"openpitrix,omitempty" mapstructure:"openpitrix"`
+	MonitoringOptions     *prometheus.Options                `json:"monitoring,omitempty" yaml:"monitoring,omitempty" mapstructure:"monitoring"`
+	LoggingOptions        *elasticsearch.Options             `json:"logging,omitempty" yaml:"logging,omitempty" mapstructure:"logging"`
+	AuthenticationOptions *authoptions.AuthenticationOptions `json:"authentication,omitempty" yaml:"authentication,omitempty" mapstructure:"authentication"`
 	// Options used for enabling components, not actually used now. Once we switch Alerting/Notification API to kubesphere,
 	// we can add these options to kubesphere command lines
 	AlertingOptions     *alerting.Options     `json:"alerting,omitempty" yaml:"alerting,omitempty" mapstructure:"alerting"`
@@ -89,21 +83,20 @@ type Config struct {
 // newConfig creates a default non-empty Config
 func New() *Config {
 	return &Config{
-		MySQLOptions:        mysql.NewMySQLOptions(),
-		DevopsOptions:       jenkins.NewDevopsOptions(),
-		SonarQubeOptions:    sonarqube.NewSonarQubeOptions(),
-		KubernetesOptions:   k8s.NewKubernetesOptions(),
-		ServiceMeshOptions:  servicemesh.NewServiceMeshOptions(),
-		LdapOptions:         ldap.NewOptions(),
-		RedisOptions:        cache.NewRedisOptions(),
-		S3Options:           s3.NewS3Options(),
-		OpenPitrixOptions:   openpitrix.NewOptions(),
-		MonitoringOptions:   prometheus.NewPrometheusOptions(),
-		KubeSphereOptions:   kubesphere.NewKubeSphereOptions(),
-		AlertingOptions:     alerting.NewAlertingOptions(),
-		NotificationOptions: notification.NewNotificationOptions(),
-		LoggingOptions:      elasticsearch.NewElasticSearchOptions(),
-		AuthenticateOptions: auth.NewAuthenticateOptions(),
+		MySQLOptions:          mysql.NewMySQLOptions(),
+		DevopsOptions:         jenkins.NewDevopsOptions(),
+		SonarQubeOptions:      sonarqube.NewSonarQubeOptions(),
+		KubernetesOptions:     k8s.NewKubernetesOptions(),
+		ServiceMeshOptions:    servicemesh.NewServiceMeshOptions(),
+		LdapOptions:           ldap.NewOptions(),
+		RedisOptions:          cache.NewRedisOptions(),
+		S3Options:             s3.NewS3Options(),
+		OpenPitrixOptions:     openpitrix.NewOptions(),
+		MonitoringOptions:     prometheus.NewPrometheusOptions(),
+		AlertingOptions:       alerting.NewAlertingOptions(),
+		NotificationOptions:   notification.NewNotificationOptions(),
+		LoggingOptions:        elasticsearch.NewElasticSearchOptions(),
+		AuthenticationOptions: authoptions.NewAuthenticateOptions(),
 	}
 }

@@ -125,17 +118,9 @@ func TryLoadFromDisk() (*Config, error) {
 	}

 	conf := New()
+
 	if err := viper.Unmarshal(conf); err != nil {
 		return nil, err
-	} else {
-		// make sure kubesphere options always exists
-		if conf.KubeSphereOptions == nil {
-			conf.KubeSphereOptions = kubesphere.NewKubeSphereOptions()
-		} else {
-			ksOptions := kubesphere.NewKubeSphereOptions()
-			conf.KubeSphereOptions.ApplyTo(ksOptions)
-			conf.KubeSphereOptions = ksOptions
-		}
 	}

 	return conf, nil
@@ -151,7 +136,7 @@ func (conf *Config) InstallAPI(c *restful.Container) {
 	ws.Route(ws.GET("/configz").
 		To(func(request *restful.Request, response *restful.Response) {
 			conf.stripEmptyOptions()
-			response.WriteAsJson(conf.toMap())
+			response.WriteAsJson(conf.ToMap())
 		}).
 		Doc("Get system components configuration").
 		Produces(restful.MIME_JSON).
@@ -163,7 +148,8 @@ func (conf *Config) InstallAPI(c *restful.Container) {

 // convertToMap simply converts config to map[string]bool
 // to hide sensitive information
-func (conf *Config) toMap() map[string]bool {
+func (conf *Config) ToMap() map[string]bool {
+	conf.stripEmptyOptions()
 	result := make(map[string]bool, 0)

 	if conf == nil {
--- a/pkg/apiserver/config/config_test.go
+++ b/pkg/apiserver/config/config_test.go
@@ -2,14 +2,15 @@ package config

 import (
 	"fmt"
+	"github.com/google/go-cmp/cmp"
 	"gopkg.in/yaml.v2"
 	"io/ioutil"
-	"kubesphere.io/kubesphere/pkg/api/auth"
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
+	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/simple/client/alerting"
 	"kubesphere.io/kubesphere/pkg/simple/client/cache"
 	"kubesphere.io/kubesphere/pkg/simple/client/devops/jenkins"
 	"kubesphere.io/kubesphere/pkg/simple/client/k8s"
-	"kubesphere.io/kubesphere/pkg/simple/client/kubesphere"
 	"kubesphere.io/kubesphere/pkg/simple/client/ldap"
 	"kubesphere.io/kubesphere/pkg/simple/client/logging/elasticsearch"
 	"kubesphere.io/kubesphere/pkg/simple/client/monitoring/prometheus"
@@ -26,7 +27,7 @@ import (
 )

 func newTestConfig() *Config {
-	conf := &Config{
+	var conf = &Config{
 		MySQLOptions: &mysql.Options{
 			Host:                  "10.68.96.5:3306",
 			Username:              "root",
@@ -96,22 +97,46 @@ func newTestConfig() *Config {
 			IndexPrefix: "elk",
 			Version:     "6",
 		},
-		KubeSphereOptions: &kubesphere.Options{
-			APIServer:     "http://ks-apiserver.kubesphere-system.svc",
-			AccountServer: "http://ks-account.kubesphere-system.svc",
-		},
 		AlertingOptions: &alerting.Options{
 			Endpoint: "http://alerting.kubesphere-alerting-system.svc:9200",
 		},
 		NotificationOptions: &notification.Options{
 			Endpoint: "http://notification.kubesphere-alerting-system.svc:9200",
 		},
-		AuthenticateOptions: &auth.AuthenticationOptions{
+		AuthenticationOptions: &authoptions.AuthenticationOptions{
 			AuthenticateRateLimiterMaxTries: 5,
 			AuthenticateRateLimiterDuration: 30 * time.Minute,
 			MaxAuthenticateRetries:          6,
-			TokenExpiration:                 30 * time.Minute,
+			JwtSecret:                       "xxxxxx",
 			MultipleLogin:                   false,
+			OAuthOptions: &oauth.Options{
+				IdentityProviders: []oauth.IdentityProvider{{
+					Name:          "github",
+					MappingMethod: "auto",
+					LoginRedirect: true,
+					Type:          oauth.IdentityProviderTypeGithub,
+					Github: &oauth.Github{
+						ClientID:     "de6ff7bed0304e487b6e",
+						ClientSecret: "xxxxxx-xxxxx-xxxxx",
+						Endpoint: oauth.Endpoint{
+							AuthURL:  "https://github.com/login/oauth/authorize",
+							TokenURL: "https://github.com/login/oauth/token",
+						},
+						RedirectURL: "https://ks-console.kubesphere-system.svc/oauth/callbak/github",
+						Scopes:      []string{"user"},
+					},
+				}},
+				Clients: []oauth.Client{{
+					Name:                                "kubesphere-console-client",
+					Secret:                              "xxxxxx-xxxxxx-xxxxxx",
+					RespondWithChallenges:               true,
+					RedirectURIs:                        []string{"http://ks-console.kubesphere-system.svc/oauth/token/implicit"},
+					GrantMethod:                         oauth.GrantHandlerAuto,
+					AccessTokenInactivityTimeoutSeconds: nil,
+				}},
+				AccessTokenMaxAgeSeconds:            86400,
+				AccessTokenInactivityTimeoutSeconds: 0,
+			},
 		},
 	}
 	return conf
@@ -153,47 +178,8 @@ func TestGet(t *testing.T) {
 		t.Fatal(err)
 	}

+	cmp.Diff(conf, conf2)
 	if diff := reflectutils.Equal(conf, conf2); diff != nil {
 		t.Fatal(diff)
 	}
 }
-
-func TestKubeSphereOptions(t *testing.T) {
-	conf := newTestConfig()
-
-	t.Run("save nil kubesphere options", func(t *testing.T) {
-		savedConf := *conf
-		savedConf.KubeSphereOptions = nil
-		saveTestConfig(t, &savedConf)
-		defer cleanTestConfig(t)
-
-		loadedConf, err := TryLoadFromDisk()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		if diff := reflectutils.Equal(conf, loadedConf); diff != nil {
-			t.Fatal(diff)
-		}
-	})
-
-	t.Run("save partially kubesphere options", func(t *testing.T) {
-		savedConf := *conf
-		savedConf.KubeSphereOptions.APIServer = "http://example.com"
-		savedConf.KubeSphereOptions.AccountServer = ""
-
-		saveTestConfig(t, &savedConf)
-		defer cleanTestConfig(t)
-
-		loadedConf, err := TryLoadFromDisk()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		savedConf.KubeSphereOptions.AccountServer = "http://ks-account.kubesphere-system.svc"
-
-		if diff := reflectutils.Equal(&savedConf, loadedConf); diff != nil {
-			t.Fatal(diff)
-		}
-	})
-}