Authentication Microservice POC #15765

jalbinson · 2024-09-03T18:45:57Z

This PR creates a new Spring Microservice focused on authentication via Okta and proxying requests to the right service.

Test Steps:

Run unit tests in auth project to ensure all is working locally
Ask me for staging secret for okta and set to proper environment variable locally (I'll help)
Ask Arnej for script to retrieve valid auth token, use it to get auth token
Startup this service and the submissions service
Call http://localhost:9000/submissions/health
Ensure you get a 200 response with the body "up"

Changes

New microservice
Additional code added in submissions for future handling of authorization

Checklist

Testing

Tested locally?
Ran ./prime test or ./gradlew testSmoke against local Docker ReportStream container?
Added tests?

Linked Issues

Fixes Auth Microservice POC #15623

auth/gradle.properties

auth/src/main/resources/application.yml

auth/src/test/kotlin/gov/cdc/prime/reportstream/auth/controller/AuthControllerTest.kt

...sions/src/main/kotlin/gov/cdc/prime/reportstream/submissions/controllers/HealthController.kt

david-navapbc · 2024-09-10T02:22:03Z

all in all this is awesome work! nice job

couple of quick things

whatever the directory structure for the project is should probably be the directory structure for all of the services (or at least close to it). Might want to think now about where you are going to want to put your repositories, whether or not you want "model" to be the package name for both json entities and db DAOs. Not a big deal rn. Something to think on given this is the first and therefore the reference implementation.
if we're going to be using webflux we should document the pattern and ensure we don't mix reactive and non-reactive code.

david-navapbc · 2024-09-10T00:30:18Z

auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/config/SecurityConfig.kt

+        http
+            .authorizeExchange { authorize ->
+                authorize
+                    .pathMatchers("/health").permitAll() // allow health endpoint without authentication


see comment in controller re keeping things DRY

auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/controller/HealthController.kt

auth/src/main/resources/application.yml

submissions/src/main/kotlin/gov/cdc/prime/reportstream/submissions/config/SecurityConfig.kt

david-navapbc · 2024-09-10T02:00:17Z

auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/service/ProxyURIStrategy.kt

+                incomingUri.fragment
+            )
+        } else {
+            throw IllegalStateException("no configured proxy target in path mappings for path=${incomingUri.path}")


how is this - and for that matter any - unexpected exception handled? If memory serves spring-boot will return an html document to the user. If that's what's going on and that's not what we want - you can use @RestControllerAdvice to create a global catch-all to ensure all exceptions result in a consistent return value protocol to the user.

Right now it returns a default Spring json response. It's definitely in my todo list for the app to make that better but figured it was ok for now.

david-navapbc · 2024-09-10T14:20:35Z

one more thing!

there's a plugin we can use to auto-generate swagger doc

https://springdoc.org/#gradle-plugin

It auto generates both the openapi file and creates an endpoint to view the API contract

jalbinson · 2024-09-10T17:52:45Z

whatever the directory structure for the project is should probably be the directory structure for all of the services (or at least close to it). Might want to think now about where you are going to want to put your repositories, whether or not you want "model" to be the package name for both json entities and db DAOs. Not a big deal rn. Something to think on given this is the first and therefore the reference implementation.

I think this is good enough for now. The current idea is that this will not be hooked up to any db or datastore so thats not something we'd have to worry about.

…ortstream into platform/jamie/auth-poc

mkalish

Nice stuff! Since this is just a POC I'm good moving forward with this.

mkalish · 2024-09-16T17:19:47Z

auth/build.gradle.kts

+
+    testImplementation("org.springframework.boot:spring-boot-starter-test")
+    testImplementation("org.springframework.security:spring-security-test")
+    testImplementation("org.jetbrains.kotlin:kotlin-test-junit5")


I think some of these can be consolidated into the shared plugin?

mkalish · 2024-09-16T17:20:25Z

auth/gradle/wrapper/gradle-wrapper.jar

I'm not sure we need this file?

mkalish · 2024-09-16T17:20:37Z

auth/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME


auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/config/ApplicationConfig.kt

mkalish · 2024-09-16T17:26:50Z

auth/src/main/resources/application.yml

+    oauth2:
+      resourceserver:
+        opaquetoken: # Set client secret in SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT_SECRET env variable
+          client-id: 0oaek8tip2lhrhHce1d7


I think we'll need to figure out how to make this per env too?

I believe that environment variables take precedence over configuration in application.yml so will just need to set the correct env variables per environment.

mkalish · 2024-09-16T17:27:09Z

auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/controller/HealthController.kt

+import kotlin.time.TimeSource
+
+@RestController
+class HealthController(


Maybe out of scope, but this could also check that okta is available?

interesting idea. It's possible. I would hesitate to tie it directly to the healthcheck endpoint as those can sometimes be used to ensure the app is functioning properly in a k8s environment (Okta going down could take us down with it).

mkalish · 2024-09-16T17:28:47Z

auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/service/ProxyURIStrategy.kt

+/**
+ * Implementations are ways to decide the ultimate destination of an incoming request
+ */
+interface ProxyURIStrategy {


Is this what the spring gateway would replace?

Thats the idea.

We could define it in configuration that

/reports -> http://localhost:8000/reports /submission -> http://localhost:8888/submission etc

mkalish · 2024-09-16T17:33:59Z

submissions/src/main/resources/application.properties

+azure.storage.table-name=${AZURE_STORAGE_TABLE_NAME:submission}
+spring.security.oauth2.resourceserver.jwt.issuer-uri=https://reportstream.oktapreview.com/oauth2/ausekaai7gUuUtHda1d7


Probably a follow up, but this is all going to be per env right?

Yes. This is the Okta preview site. In production we would set an env variable pointing to production Okta.

submissions/src/main/kotlin/gov/cdc/prime/reportstream/submissions/config/SecurityConfig.kt

…plicationConfig.kt Co-authored-by: Michael Kalish <[email protected]>

david-navapbc

nice job!

jalbinson added 2 commits August 27, 2024 14:22

checkpoint before I delete a lot of potentially unneeded work

312ffb4

much cleaner

b038476

jalbinson temporarily deployed to staging September 3, 2024 18:46 — with GitHub Actions Inactive

unit tests

6fdb013

jalbinson temporarily deployed to staging September 5, 2024 18:28 — with GitHub Actions Inactive

jalbinson commented Sep 5, 2024

View reviewed changes

auth/gradle.properties Outdated Show resolved Hide resolved

cleanup

a9cb906

jalbinson temporarily deployed to staging September 5, 2024 20:22 — with GitHub Actions Inactive

jalbinson commented Sep 5, 2024

View reviewed changes

auth/src/main/resources/application.yml Outdated Show resolved Hide resolved

jalbinson commented Sep 5, 2024

View reviewed changes

auth/src/test/kotlin/gov/cdc/prime/reportstream/auth/controller/AuthControllerTest.kt Outdated Show resolved Hide resolved

Merge branch 'master' into platform/jamie/auth-poc

1663c1a

jalbinson added the platform Platform Team label Sep 6, 2024

jalbinson changed the title ~~Platform/jamie/auth poc~~ Auth poc Sep 6, 2024

Andrey-Glazkv assigned david-navapbc Sep 6, 2024

jalbinson commented Sep 6, 2024

View reviewed changes

...sions/src/main/kotlin/gov/cdc/prime/reportstream/submissions/controllers/HealthController.kt Outdated Show resolved Hide resolved

jalbinson changed the title ~~Auth poc~~ Authentication Microservice POC Sep 6, 2024

jalbinson marked this pull request as ready for review September 6, 2024 17:39

jalbinson added 2 commits September 6, 2024 13:39

Merge branch 'master' into platform/jamie/auth-poc

4bbe1a1

merge master

56ffab0

jalbinson temporarily deployed to staging September 6, 2024 17:41 — with GitHub Actions Inactive

more cleanup

b8d8bd7

jalbinson temporarily deployed to staging September 6, 2024 18:32 — with GitHub Actions Inactive

Merge branch 'master' into platform/jamie/auth-poc

56e4011

jalbinson temporarily deployed to staging September 9, 2024 14:27 — with GitHub Actions Inactive

david-navapbc reviewed Sep 10, 2024

View reviewed changes

jalbinson added 2 commits September 12, 2024 14:01

PR feedback

50e18b1

Merge branch 'platform/jamie/auth-poc' of github.com:CDCgov/prime-rep…

dbc7e1e

…ortstream into platform/jamie/auth-poc

fix conflicts

3264387

jalbinson temporarily deployed to staging September 12, 2024 18:05 — with GitHub Actions Inactive

Merge branch 'master' into platform/jamie/auth-poc

dbe3ff2

jalbinson temporarily deployed to staging September 13, 2024 15:26 — with GitHub Actions Inactive

jalbinson added 2 commits September 13, 2024 11:31

add comment

99b11c2

Merge branch 'platform/jamie/auth-poc' of github.com:CDCgov/prime-rep…

44265ca

…ortstream into platform/jamie/auth-poc

jalbinson temporarily deployed to staging September 13, 2024 15:32 — with GitHub Actions Inactive

Merge branch 'master' into platform/jamie/auth-poc

8c65ba3

jalbinson temporarily deployed to staging September 13, 2024 19:59 — with GitHub Actions Inactive

Merge branch 'master' into platform/jamie/auth-poc

9435857

jalbinson temporarily deployed to staging September 16, 2024 17:45 — with GitHub Actions Inactive

mkalish approved these changes Sep 16, 2024

View reviewed changes

Update auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/config/Ap…

90080f4

…plicationConfig.kt Co-authored-by: Michael Kalish <[email protected]>

jalbinson temporarily deployed to staging September 16, 2024 19:41 — with GitHub Actions Inactive

Merge branch 'master' into platform/jamie/auth-poc

14c26aa

jalbinson temporarily deployed to staging September 16, 2024 19:48 — with GitHub Actions Inactive

PR feedback

b14ff38

jalbinson temporarily deployed to staging September 17, 2024 14:44 — with GitHub Actions Inactive

Merge branch 'master' into platform/jamie/auth-poc

03905f3

jalbinson temporarily deployed to staging September 17, 2024 15:39 — with GitHub Actions Inactive

david-navapbc approved these changes Sep 17, 2024

View reviewed changes

jalbinson merged commit 0bc5345 into master Sep 17, 2024
16 checks passed

jalbinson deleted the platform/jamie/auth-poc branch September 17, 2024 17:49

thetaurean pushed a commit that referenced this pull request Sep 17, 2024

Authentication Microservice POC (#15765)

efa882c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Authentication Microservice POC #15765

Authentication Microservice POC #15765

jalbinson commented Sep 3, 2024 •

edited

Loading

david-navapbc commented Sep 10, 2024

david-navapbc Sep 10, 2024

david-navapbc Sep 10, 2024

jalbinson Sep 10, 2024

david-navapbc commented Sep 10, 2024

jalbinson commented Sep 10, 2024

mkalish left a comment

mkalish Sep 16, 2024

mkalish Sep 16, 2024

mkalish Sep 16, 2024

mkalish Sep 16, 2024

jalbinson Sep 16, 2024

mkalish Sep 16, 2024

jalbinson Sep 16, 2024

mkalish Sep 16, 2024

jalbinson Sep 16, 2024

mkalish Sep 16, 2024

jalbinson Sep 16, 2024

david-navapbc left a comment

		azure.storage.table-name=${AZURE_STORAGE_TABLE_NAME:submission}
		spring.security.oauth2.resourceserver.jwt.issuer-uri=https://reportstream.oktapreview.com/oauth2/ausekaai7gUuUtHda1d7

Authentication Microservice POC #15765

Authentication Microservice POC #15765

Conversation

jalbinson commented Sep 3, 2024 • edited Loading

Changes

Checklist

Testing

Linked Issues

david-navapbc commented Sep 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

david-navapbc commented Sep 10, 2024

jalbinson commented Sep 10, 2024

mkalish left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

david-navapbc left a comment

Choose a reason for hiding this comment

jalbinson commented Sep 3, 2024 •

edited

Loading