|
| 1 | +--- |
| 2 | +'hive': major |
| 3 | +--- |
| 4 | + |
| 5 | +**BREAKING** Remove support for `supertokens` service and replace it with native authentication solution. |
| 6 | + |
| 7 | +## Upgrade Guide |
| 8 | + |
| 9 | +Adjust your docker compose file like the following: |
| 10 | +- Remove `services.supertokens` from your `docker-compose.community.yml` file |
| 11 | +- Remove the following environment variables from the `services.server.environment` |
| 12 | + - `SUPERTOKENS_CONNECTION_URI=` |
| 13 | + - `SUPERTOKENS_API_KEY=` |
| 14 | +- Set the following environment variables for `services.server.environment` |
| 15 | + - `SUPERTOKENS_REFRESH_TOKEN_KEY=` |
| 16 | + - `SUPERTOKENS_ACCESS_TOKEN_KEY=` |
| 17 | + |
| 18 | +### Set the refresh token key |
| 19 | + |
| 20 | +#### Extract from existing `supertokens` deployment |
| 21 | + |
| 22 | +This method works if you use supertokens before and want to have existing user sessions to continue working. |
| 23 | +If you want to avoid messing with the database, you can also create a new refresh token key from scratch, the drawback is that users are forced to login again. |
| 24 | + |
| 25 | +Extract the refresh token key from the supertokens database |
| 26 | +```sql |
| 27 | +SELECT "value" FROM "supertokens_key_value" WHERE "name" = 'refresh_token_key'; |
| 28 | +``` |
| 29 | + |
| 30 | +The key should look similar to this: `1000:15e5968d52a9a48921c1c63d88145441a8099b4a44248809a5e1e733411b3eeb80d87a6e10d3390468c222f6a91fef3427f8afc8b91ea1820ab10c7dfd54a268:39f72164821e08edd6ace99f3bd4e387f45fa4221fe3cd80ecfee614850bc5d647ac2fddc14462a00647fff78c22e8d01bc306a91294f5b889a90ba891bf0aa0` |
| 31 | + |
| 32 | +Update the docker compose `services.server.environment.SUPERTOKENS_REFRESH_TOKEN_KEY` environment variable value to this string. |
| 33 | + |
| 34 | +#### Create from scratch |
| 35 | + |
| 36 | +Run the following command to create a new refresh key from scratch: |
| 37 | + |
| 38 | +```sh |
| 39 | +echo "1000:$(openssl rand -hex 64):$(openssl rand -hex 64)" |
| 40 | +``` |
| 41 | + |
| 42 | +### Set the access token key |
| 43 | + |
| 44 | +Generate a new access token key using the following instructions: |
| 45 | + |
| 46 | +```sh |
| 47 | +# 1. Generate a unique key name. 'uuidgen' is great for this. |
| 48 | +# You can replace this with any string you like, e.g., KEY_NAME="my-app-key-1" |
| 49 | +KEY_NAME=$(uuidgen) |
| 50 | +# 2. Generate a 2048-bit RSA private key in PEM format, held in memory. |
| 51 | +PRIVATE_KEY_PEM=$(openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048) |
| 52 | +# 3. Extract the corresponding public key from the private key, also held in memory. |
| 53 | +PUBLIC_KEY_PEM=$(echo "$PRIVATE_KEY_PEM" | openssl rsa -pubout) |
| 54 | +# 4. Strip the headers/footers and newlines from the private key PEM |
| 55 | +# to get just the raw Base64 data. |
| 56 | +PRIVATE_KEY_DATA=$(echo "$PRIVATE_KEY_PEM" | awk 'NF {if (NR!=1 && $0!~/-----END/) print}' | tr -d '\n') |
| 57 | +# 5. Do the same for the public key PEM. |
| 58 | +PUBLIC_KEY_DATA=$(echo "$PUBLIC_KEY_PEM" | awk 'NF {if (NR!=1 && $0!~/-----END/) print}' | tr -d '\n') |
| 59 | +# 6. Echo the final formatted string to the console. |
| 60 | +echo "${KEY_NAME}|${PUBLIC_KEY_DATA}|${PRIVATE_KEY_DATA}" |
| 61 | +``` |
| 62 | + |
| 63 | +Update the docker compose `services.server.environment.SUPERTOKENS_ACCESS_TOKEN_KEY` environment variable value to the formatted string output. |
| 64 | + |
| 65 | +## Conclusion |
| 66 | + |
| 67 | +After performing this updates you can run Hive Console without the need for the `supertokens` service. All the relevant authentication logic resides within the `server` container instead. |
| 68 | + |
| 69 | +Existing users in the supertokens system will continue to exist when running without the `supertokens` service. |
0 commit comments