Feature: SSO Migration - DESENG #408 #2333

NatSquared · 2023-11-06T22:55:58Z

Issue #: https://apps.itsm.gov.bc.ca/jira/browse/DESENG-408

Description of changes:

v1.1.0 - 2023-11-06

Feature: Switch MET to use Keycloak SSO service - 🎟️DESENG-408

Switch all role-based checks on the API to use a single callback function (current_app.config['JWT_ROLE_CALLBACK'])

Added a configurable path JWT_ROLE_CLAIM to indicate where your SSO instance places role information in the JWT token. If your access token looks like:
{ ..., "realm_access": { "roles": [ "role1", "role2"]}} you would set JWT_ROLE_CLAIM=realm_access.roles

Explicitly disable single tenant mode to ensure correct multi-tenancy behaviour

Remove local Keycloak instances and configuration

Potentially breaking: Default to the "standard" realm for Keycloak

Potentially breaking: Use tenancy information from DB rather than Keycloak

Feature: .env var audit and cleanup - 🎟️DESENG-414

Update sample.env files to properly reflect the current state of the project and document where to download credentials securely
This ticket is not closed by this version

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the met-public license (Apache 2.0).

sonarqubecloud · 2023-11-06T22:57:29Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

Baelx · 2023-11-06T23:16:27Z

met-api/src/met_api/__init__.py

+        Consumes a token_info dictionary and returns a list of roles.
+        Uses a configurable path to the roles in the token_info dictionary.
+        """
+        role_access_path = app_context.config['JWT_ROLE_CLAIM']


Nice touch with the customizable path. Will be nice to have while we're in this transition period between auth providers.

Baelx · 2023-11-06T23:17:56Z

met-api/src/met_api/models/base_model.py

-        db.session.add(self)
-        db.session.flush()
-        db.session.commit()
+        self.flush()


Does self access db.session in this instance?

The first argument to a method of a class (called self by convention) always receives a reference to the class itself (in this case, BaseModel). So self.flush() is the same as BaseModel.flush(), which behind the scenes gets called as something like BaseModel.flush(self=BaseModel)

Baelx · 2023-11-06T23:38:50Z

met-web/sample.env

-# Resource identifier for the Keycloak client
-REACT_APP_KEYCLOAK_CLIENT=modern-engagement-tools-4787
+# Keycloak auth
+# Copy from 'GDX MET web (public)-installation-*.json'


Nice helpful notes to aid in gathering those env variables

Baelx · 2023-11-06T23:54:57Z

met-api/src/met_api/services/authorization.py

    token_roles = set(user_from_context.roles)
    permitted_roles = set(kwargs.get('one_of_roles', []))
    has_valid_roles = token_roles & permitted_roles
    if has_valid_roles:
        if not skip_tenant_check:
-            user_tenant_id = user_from_context.tenant_id
+            user_tenant_id = user_from_db.tenant_id


If I understand correctly, you switched accessing the "current" user from app context to pulling that user from the DB. Was the former solution causing issues?

Baelx · 2023-11-07T00:07:34Z

APPROVED: Nice work on this! I especially appreciate the comments and detailed changelog and PR notes. Looks good :)

* Make role checks platform-agnostic * default to standard realm * Remove local Keycloak instances and config * Use tenant information from DB instead of Keycloak * Update sample.env files * Clean up the changelog... and we're good to go! 🥳

* Feature: SSO Migration - DESENG #408 (#2333) * Make role checks platform-agnostic * default to standard realm * Remove local Keycloak instances and config * Use tenant information from DB instead of Keycloak * Update sample.env files * Clean up the changelog... and we're good to go! 🥳 * [DESENG-414] .env var (and config) audit and cleanup (#2339) * Overhaul of most configuration files * No longer using semver; update CHANGELOG.MD * Feature/deseng415 (#2334) * feature/deseng415: Added recording of date with feedback submission and displaying the data on admin side. * feature/deseng415: Fixed feedback schema, removed yup import, fixed change log date. * bugfix/deseng429: Removed outdated service class. (#2337) * bugfix/deseng429: Removed outdated service class. * bugfix/deseng429: Changed version and changelog to match deployments to gdx-main. * DESENG-438 Superusers can publish engagements without attached surveys (#2338) * DESENG-441 Remove unused engagement metadata fields (#2340) * Fixed merge errors in the changelog --------- Co-authored-by: jareth-whitney <110929259+jareth-whitney@users.noreply.github.com> Co-authored-by: Baelx <16845197+Baelx@users.noreply.github.com> Co-authored-by: Alex <awintschel@gmail.com> Well done team! 💖

* Bugfix/deseng413 (#2330) * bugfix/deseng413: Upgraded BC-Sans font to newest version. * bugfix/deseng413: Small update to changelog for clarification. * Feature: SSO Migration - DESENG #408 (#2333) * Make role checks platform-agnostic * default to standard realm * Remove local Keycloak instances and config * Use tenant information from DB instead of Keycloak * Update sample.env files * Clean up the changelog... and we're good to go! 🥳 * [DESENG-414] .env var (and config) audit and cleanup (#2339) * Overhaul of most configuration files * No longer using semver; update CHANGELOG.MD * Feature/deseng415 (#2334) * feature/deseng415: Added recording of date with feedback submission and displaying the data on admin side. * feature/deseng415: Fixed feedback schema, removed yup import, fixed change log date. * bugfix/deseng429: Removed outdated service class. (#2337) * bugfix/deseng429: Removed outdated service class. * bugfix/deseng429: Changed version and changelog to match deployments to gdx-main. * DESENG-438 Superusers can publish engagements without attached surveys (#2338) * DESENG-441 Remove unused engagement metadata fields (#2340) * Fixed merge errors in the changelog --------- Co-authored-by: jareth-whitney <110929259+jareth-whitney@users.noreply.github.com> Co-authored-by: Baelx <16845197+Baelx@users.noreply.github.com> Co-authored-by: Alex <awintschel@gmail.com> Well done team! 💖

* Add initial version of change log (#2318) * Feature/update sample env files (#2320) * Remove old production .env file * Update DEVELOPMENT.md to reflect project state * Update CHANGELOG.md before PR * Link JIRA ticket # on relevant changes * Bring bugfixes from main into gdx-dev (#2328) * Made slug url case insensitive , Fixed bug with wrong query join for submission (#2321) * CSV export made working for multipage wizard surveys (#2322) --------- Co-authored-by: saravanpa-aot <saravankumar.pa@aot-technologies.com> * bugfix/deseng421: Changed engagement links so that they open in the same window/tab as opposed to a new one. (#2329) * Merge SSO and dev changes into gdx-main (#2343) * Bugfix/deseng413 (#2330) * bugfix/deseng413: Upgraded BC-Sans font to newest version. * bugfix/deseng413: Small update to changelog for clarification. * Feature: SSO Migration - DESENG #408 (#2333) * Make role checks platform-agnostic * default to standard realm * Remove local Keycloak instances and config * Use tenant information from DB instead of Keycloak * Update sample.env files * Clean up the changelog... and we're good to go! 🥳 * [DESENG-414] .env var (and config) audit and cleanup (#2339) * Overhaul of most configuration files * No longer using semver; update CHANGELOG.MD * Feature/deseng415 (#2334) * feature/deseng415: Added recording of date with feedback submission and displaying the data on admin side. * feature/deseng415: Fixed feedback schema, removed yup import, fixed change log date. * bugfix/deseng429: Removed outdated service class. (#2337) * bugfix/deseng429: Changed version and changelog to match deployments to gdx-main. * DESENG-438 Superusers can publish engagements without attached surveys (#2338) * DESENG-441 Remove unused engagement metadata fields (#2340) * Fixed merge errors in the changelog --------- Co-authored-by: saravanpa-aot <saravankumar.pa@aot-technologies.com> Co-authored-by: jareth-whitney <110929259+jareth-whitney@users.noreply.github.com> Co-authored-by: Baelx <16845197+Baelx@users.noreply.github.com> Co-authored-by: Alex <awintschel@gmail.com> Thank you, everyone! ---------

NatSquared added 7 commits November 6, 2023 22:20

Make role checks platform-agnostic

f3db3c4

default to standard realm

2db901d

Remove local Keycloak instances and config

11205ee

Use tenant information from DB instead of Keycloak

f71a408

Update sample.env files

46a428e

Clean up the changelog... and we're good to go! 🥳

ae67c76

Clean up the changelog... and we're good to go! 🥳

4182082

NatSquared requested review from a team and kshapka-bcgov and removed request for a team November 6, 2023 22:55

NatSquared requested review from jadmsaadaot, djnunez-aot, saravanpa-aot and VineetBala-AOT as code owners November 6, 2023 22:55

NatSquared requested review from jareth-whitney and a team November 6, 2023 22:56

Baelx reviewed Nov 6, 2023

View reviewed changes

NatSquared merged commit 585def0 into gdx-sso Nov 7, 2023
2 checks passed

NatSquared deleted the feature/deseng-408-sso-migration branch December 1, 2023 02:19

NatSquared restored the feature/deseng-408-sso-migration branch December 1, 2023 02:19

NatSquared deleted the feature/deseng-408-sso-migration branch December 11, 2023 18:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: SSO Migration - DESENG #408 #2333

Feature: SSO Migration - DESENG #408 #2333

NatSquared commented Nov 6, 2023 •

edited

Loading

sonarqubecloud bot commented Nov 6, 2023

Baelx Nov 6, 2023

Baelx Nov 6, 2023

NatSquared Nov 6, 2023 •

edited

Loading

Baelx Nov 6, 2023

Baelx Nov 6, 2023

Baelx commented Nov 7, 2023

Feature: SSO Migration - DESENG #408 #2333

Feature: SSO Migration - DESENG #408 #2333

Conversation

NatSquared commented Nov 6, 2023 • edited Loading

v1.1.0 - 2023-11-06

sonarqubecloud bot commented Nov 6, 2023

Baelx Nov 6, 2023

Choose a reason for hiding this comment

Baelx Nov 6, 2023

Choose a reason for hiding this comment

NatSquared Nov 6, 2023 • edited Loading

Choose a reason for hiding this comment

Baelx Nov 6, 2023

Choose a reason for hiding this comment

Baelx Nov 6, 2023

Choose a reason for hiding this comment

Baelx commented Nov 7, 2023

NatSquared commented Nov 6, 2023 •

edited

Loading

NatSquared Nov 6, 2023 •

edited

Loading