9357 idp-seam-integration - #6681
Open
ttoomey wants to merge 15 commits into
Open
Conversation
This reverts commit 766242f.
Add JWT authentication for warehouse request layer Support AUTH_METHOD=jwt as an alternative to the default Devise/Warden flow, covering requests, ActionCable, and rack-attack. HMIS wiring is a follow-up PR. - Extract Devise/Warden logic into DeviseCurrentUser concern; add Idp::JwtCurrentUser as the JWT equivalent - Deny deactivated users even with a valid JWT (403, not sign-in loop) - Route Devise/Doorkeeper vs Idp::SessionsController by AuthMethod, preserving existing *_path helpers - Authenticate ActionCable/rack-attack via Idp::JwtHelper and User.find_from_jwt under JWT mode - Gate Devise/OmniAuth/AuthTrail initializers and sign-in UI behind AuthMethod.devise?; enable Keycloak under JWT
ttoomey
changed the title
Move the JWT authentication code into a shared concern so HMIS can use it too, instead of copying what the warehouse already has. HMIS still falls back to the existing Devise/Pretender auth when JWT is not the configured auth method, so this does not change behavior for anyone not using JWT. Also fixes a couple of bugs: impersonation not saving correctly on the first request, and a sign-out redirect that was not checking the destination properly. Updates CI to run the new HMIS tests, and adds a check to stop the Keycloak migration scripts from running unless Devise is enabled, since they need Devise data to work.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # forged cross-site request triggering that is a forced-logout nuisance at worst, not a | ||
| # meaningful escalation - the actual credential (the oauth2-proxy/IdP session) is untouched | ||
| # here regardless and only ends when the browser follows the returned redirect_url. | ||
| skip_before_action :verify_authenticity_token, only: :destroy |
11 tasks
…6718) Add a machine-to-machine endpoint (`/api/superset/user_roles`) to allow Superset to retrieve user roles when running in JWT mode - Gate Doorkeeper initialization under the JWT - Improve JWKS failure handling to fail closed and log exceptions - Update docs
| include LogRagePayloadBehavior | ||
|
|
||
| # Token-authenticated, session-less API | ||
| skip_forgery_protection |
Establish direct links between user accounts and Keycloak without requiring initial user authentication. - Add bulk keycloak user query - Add a service to bulk-map confirmed active users to their IDP source - Add a nightly job to trigger backfills for supported IDP service configs - Provide a Rake task entry point for manual backfill execution
User account management/admin integration with IdP; behavior selected at boot time by AUTH_METHOD. The existing Devise behavior is unchanged. The auth-agnostic bulk of the admin users controllers is extracted into shared concerns with template-method seams for the Devise-only pieces (2FA, IdP push), so the two arms stay aligned. Under the IdP arm, admins can create, deactivate/reactivate, and force password resets on accounts by pushing to Keycloak. Account provisioning links or creates the account in Keycloak and emails the user a setup link. Admin views are adapted, hiding or disabling actions that don't apply to a given IdP configuration. Also extends the Keycloak service layer (lookup, disable, force-password-change, setup email) and centralizes IdP-vs-Devise capability checks on the user model. Adds specs for the new controllers, the account-creation flow, and regression coverage of the shared surfaces under both auth methods.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging this PR
stagingandproductionDescription
IDP seams integration, see linked issue