Cleanup unused applications in auth0

[yuvipanda]

Our auth0 account has a limit of 100 applications, and we're almost at the limit. There are a lot of unused applications there, because we changed naming schemes once. There's also some duplicates, and I'm not sure why.

In reality, we have way fewer than 100 applications. We need to clean this up.

TODO

• Delete old applications that are no longer in use
• Investigate duplicate applications Fetch all auth0 clients #520

[yuvipanda]

Look at the duplicates!

[damianavila]

Mmm... interesting... maybe this is the result of multiple deployments that somehow are generating dupe apps?

[sgibson91]

I was thinking about writing a helper script to tackle the cleanup of Auth0 apps today, the process would look like the following:

1. Get all of our apps from Auth0. Structure the data as a dict {app1_name: [client_id1, client_id2, ...], app2_name: ...}
2. Filter the dict for cases where len(value) > 1
3. Print to the console which apps have multiple copies and how many copies there are.
4. OPTIONAL --purge flag which would deleted duplicated apps until all entries in the dict had len(value) == 1

I had trouble figuring out from the deployer how to set up the connection to Auth0 though 😕

[yuvipanda]

Thanks for looking into this, @sgibson91!

infrastructure/deployer/auth.py

Line 16 in fab3dc3

class KeyProvider:

is where all the auth0 related code is - we use the official auth0 python sdk. We obtain a auth0 object using credentials from our sops encrypted config/secrets.yaml, and then that gives us CRUD operations on apps / clients / connections etc.

I hope that is helpful in getting you started!

[sgibson91]

Huh, I must have run into an intermittent error on the API server as my draft script is working now 😄

[sgibson91]

I have opened #769

[choldgraf]

Is this now finished since #769 is merged?

[sgibson91]

Actually, seeing the Wageningen app reminded me that that script only copes with duplicated apps, not apps that are unused because the hubs that generated them no longer exist. At the minimum, we need to add a checkpoint to the decommission hub issue template to manually remove the Auth0 (or GitHub) app when removing a hub. But cleaning the remaining apps up now probably requires a more manual approach.

[sgibson91]

I updated the issue template in this PR #784

[damianavila]

For future readers, we no longer use Auth0.