[feat] Allow configuring argon2id parameters #4291

elland · 2024-10-10T11:29:57Z

https://wearezeta.atlassian.net/browse/WPB-9746

Checklist

Add a new entry in an appropriate subdirectory of changelog.d
Read and follow the PR guidelines

libs/wire-api/src/Wire/API/Error/Brig.hs

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs

libs/wire-subsystems/src/Wire/HashPassword.hs

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs

libs/wire-subsystems/test/unit/Wire/MockInterpreters/HashPassword.hs

services/brig/brig.integration.yaml

…ord.hs Co-authored-by: Matthias Fischmann <mf@zerobuzz.net>

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs

Always make sure the options from the server config are used if /a.

services/brig/src/Brig/User/Auth.hs

changelog.d/2-features/add-config-for-pwd-hash

- passwordHashingOptions are no longer optional in settings, expect helm chart to have set the right defaults. - Brig.Provider.DB no longer hashes password, it expects hashed password to be passed in. Functions at higher level call HashPassword effect. These will eventually move to AuthenticationSubsystem (or something similar for providers)

Optimize for test run time, not security.

Was here to inspect CI env.

Reorg changelog, so important things go on top.

retry limit.

services/brig/src/Brig/Provider/API.hs

services/brig/src/Brig/Data/User.hs

libs/wire-api/test/unit/Test/Wire/API/Password.hs

changelog.d/2-features/add-config-for-pwd-hash

docs/src/developer/reference/config-options.md

fisx

notes to self:

need to review changes to server options more closely?
are the settings correct everywhere?
do they always match between brig, galley?
is the error mapping unchanged whereever possible?

services/brig/src/Brig/User/Auth.hs

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs

…ter.hs

elland added 2 commits October 9, 2024 13:16

Removed wrong comment.

1c80e2b

Thread password hashing options through the env.

815481e

echoes-hq bot added the echoes: technical-roadmap/security More specific category, to highlight task that tackle security requirements. label Oct 10, 2024

zebot added the ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist label Oct 10, 2024

elland commented Oct 10, 2024

View reviewed changes

libs/wire-api/src/Wire/API/Error/Brig.hs Show resolved Hide resolved

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs Outdated Show resolved Hide resolved

libs/wire-subsystems/src/Wire/HashPassword.hs Show resolved Hide resolved

elland added 3 commits October 10, 2024 13:38

Renamed make cmd to avoid accidentally cleaning the whole thing.

6cd9fb4

Cleaning up.

1419f59

Clean up from review

50de042

fisx reviewed Oct 10, 2024

View reviewed changes

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs Outdated Show resolved Hide resolved

libs/wire-subsystems/test/unit/Wire/MockInterpreters/HashPassword.hs Outdated Show resolved Hide resolved

services/brig/brig.integration.yaml Outdated Show resolved Hide resolved

elland and others added 2 commits October 10, 2024 14:28

Update libs/wire-subsystems/test/unit/Wire/MockInterpreters/HashPassw…

0277ca6

…ord.hs Co-authored-by: Matthias Fischmann <mf@zerobuzz.net>

Restore necessary reauth logic

c100cb6

fisx reviewed Oct 10, 2024

View reviewed changes

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs Outdated Show resolved Hide resolved

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs Show resolved Hide resolved

elland and others added 5 commits October 10, 2024 15:59

Added a changelog.

448d81a

Add docs, beef up changelog entrie(s).

bd0a1a7

Fix: default parameters.

bfe5384

Merge remote-tracking branch 'origin/develop' into configurable-argon

80c2964

Fix: do not take a Nothing for options when hashing passwords!

44b726b

Always make sure the options from the server config are used if /a.

fisx requested changes Oct 11, 2024

View reviewed changes

services/brig/src/Brig/User/Auth.hs Show resolved Hide resolved

fisx mentioned this pull request Oct 11, 2024

Release 2024-10-09 - (expected chart version 5.6.0) #4288

Closed

fisx and others added 2 commits October 14, 2024 09:04

cp info from changelog to docs.

42a0dcb

Fixed typo.

1f4d18e

elland force-pushed the configurable-argon branch from 2360f08 to 1f4d18e Compare October 14, 2024 07:05

fisx reviewed Oct 14, 2024

View reviewed changes

changelog.d/2-features/add-config-for-pwd-hash Outdated Show resolved Hide resolved

fisx and others added 7 commits October 14, 2024 09:30

Update changelog.d/2-features/add-config-for-pwd-hash

5ab90fe

Fix: remove one more spurious call to scrypt.

4083a34

wip: Test new params for CI

c9aab24

Change the right place

85a9e03

Merge remote-tracking branch 'origin/develop' into configurable-argon

7154034

Fix/Add more tests for ssoLogin.

d678d9b

Make argon2id also fast in local integration tests.

9679e00

elland added 5 commits October 16, 2024 14:35

galley: Allow configuring password hashing options

a3d5bfe

hack/helm_var: Configure password hashing options for galley

ec11876

Optimize for test run time, not security.

brig: Removed debug logging

5ff3b18

Was here to inspect CI env.

Lint out redundant language pragma.

50c6685

akshaymankar changed the title ~~[feat] Make Argon parameters configurable through config options~~ [feat] Allow configuring argon2id parameters Oct 16, 2024

elland added 8 commits October 16, 2024 15:23

Update changelog and docs for galley and brig

721e2ff

Reorg changelog, so important things go on top.

Lint+

dc7f299

galley: Local integration config missing.

e256d56

wip: Fix authentication not handling errors correctly for decrementing

d73113c

retry limit.

Clean up and adjust error mapping.

e614940

Fix SSO login allowing non-sso users to authenticate.

28252fb

Merge remote-tracking branch 'origin/develop' into configurable-argon

6caaa71

hi ci

ef29067

fisx reviewed Oct 21, 2024

View reviewed changes

Removed stale comments.

81e6c2f

fisx reviewed Oct 21, 2024

View reviewed changes

services/brig/src/Brig/User/Auth.hs Show resolved Hide resolved

elland added 2 commits October 21, 2024 15:30

Improve in-place comments for auth/reauth/sso flow.

9e732e6

Makefile: fix full-clean.

9940aaf

elland force-pushed the configurable-argon branch from e25a8f1 to 9940aaf Compare October 21, 2024 13:35

Removed unnecessary type wrangling.

49183a4

fisx reviewed Oct 21, 2024

View reviewed changes

libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpreter.hs Outdated Show resolved Hide resolved

Update libs/wire-subsystems/src/Wire/AuthenticationSubsystem/Interpre…

715bf98

…ter.hs

fisx approved these changes Oct 21, 2024

View reviewed changes

Merge remote-tracking branch 'origin/develop' into configurable-argon

efe3415

fisx merged commit b94e3c6 into develop Oct 21, 2024
9 of 10 checks passed

fisx deleted the configurable-argon branch October 21, 2024 15:51

This was referenced Oct 23, 2024

Release 2024-10-23 - (expected chart version 5.6.0) #4305

Closed

Release 2024-10-25 - (expected chart version 5.6.0) #4312

Closed

zebot mentioned this pull request Oct 30, 2024

Release 2024-10-30 - (expected chart version 5.6.0) #4321

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[feat] Allow configuring argon2id parameters #4291

[feat] Allow configuring argon2id parameters #4291

elland commented Oct 10, 2024 •

edited

Loading

fisx left a comment

[feat] Allow configuring argon2id parameters #4291

[feat] Allow configuring argon2id parameters #4291

Conversation

elland commented Oct 10, 2024 • edited Loading

Checklist

fisx left a comment

Choose a reason for hiding this comment

elland commented Oct 10, 2024 •

edited

Loading