Add OIDC strategy for Identity #234
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
malcolmbaig
reviewed
Jul 6, 2023
malcolmbaig
reviewed
Jul 6, 2023
malcolmbaig
reviewed
Jul 6, 2023
malcolmbaig
reviewed
Jul 6, 2023
felixclack
force-pushed
the
identity-oidc
branch
4 times, most recently
from
f6653b4
to
084f094
Compare
|
This is strange because I get the opposite error on the main branch.
On July 11, 2023, "codeclimate[bot]" ***@***.***> wrote:
@malcolmbaig commented on this pull request.
In
app/controllers/qualifications/users/omniauth_callbacks_controller.rb
<https://github.com/DFE-Digital/access-your-teaching-
qualifications/pull/234#discussion_r1259662861>:
> @@ -8,7 +8,7 @@ def identity @user = User.from_identity(auth)
session[:identity_user_id] = @user.id session[:identity_user_token] =
auth.credentials.token - session[:identity_user_token_expiry] =
auth.credentials.expires_at + session[:identity_user_token_expiry] =
auth.credentials.expires_in.seconds.from_now.to_i
Testing this locally (using preprod Identity), I still get expires_at
back, leading to an exception at this line. Any idea why?
—
Reply to this email directly, view it on GitHub <https://github.com/DFE-
Digital/access-your-teaching-qualifications/pull/234#pullrequestreview-
1524153723>, or unsubscribe
<https://github.com/notifications/unsubscribe-
auth/AAAAYNRV74OZGSQVDGS7XU3XPVBIFANCNFSM6AAAAAA2AC2U7I>.
You are receiving this because you authored the thread.Message ID: <DFE-
Digital/access-your-teaching-
***@***.***>
|
malcolmbaig
reviewed
Jul 11, 2023
Sorry, ignore! Removed my original comment because I realised I hadn't tested it properly. Needed a server restart. All good as far as this attribute is concerned. |
felixclack
force-pushed
the
identity-oidc
branch
from
084f094
to
b7662bf
Compare
malcolmbaig
reviewed
Jul 11, 2023
felixclack
force-pushed
the
identity-oidc
branch
from
b7662bf
to
d19e227
Compare
malcolmbaig
reviewed
Jul 12, 2023
malcolmbaig
reviewed
Jul 12, 2023
config/initializers/omniauth.rb
Outdated
| callback_path: "/check-records/auth/dfe/callback", | ||
| client_options: { | ||
| host: dfe_sign_in_issuer_uri&.host, | ||
| identifier: ENV.fetch("DFE_SIGN_IN_CLIENT_ID", "example"), |
There was a problem hiding this comment.
I wonder if it'd be better to set a precedent and drop the default "example' value in these options? Useful for the app to crash early (during an attempt at starting the server in the dev environment, for example) so that we can pick up any misconfiguration before getting to prod.
There was a problem hiding this comment.
Made the suggested change as separate PR as it isn't directly related to this change.
felixclack
added a commit
that referenced
this pull request
Jul 13, 2023
In a [discussion on a different PR](#234 (comment)), there was a suggestion to remove the default values from the OIDC configuration to trigger misconfiguration messages sooner, eg. on app startup. The idea is that this would make development better as any misconfiguration error would be clearer.
4 tasks
felixclack
added a commit
that referenced
this pull request
Jul 13, 2023
In a [discussion on a different PR](#234 (comment)), there was a suggestion to remove the default values from the OIDC configuration to trigger misconfiguration messages sooner, eg. on app startup. The idea is that this would make development better as any misconfiguration error would be clearer.
felixclack
force-pushed
the
identity-oidc
branch
3 times, most recently
from
d77e5dd
to
cb09c8d
Compare
felixclack
added a commit
that referenced
this pull request
Jul 13, 2023
In a [discussion on a different PR](#234 (comment)), there was a suggestion to remove the default values from the OIDC configuration to trigger misconfiguration messages sooner, eg. on app startup. The idea is that this would make development better as any misconfiguration error would be clearer.
felixclack
force-pushed
the
identity-oidc
branch
from
cb09c8d
to
136e9a8
Compare
The Identity service is an OpenID Connect provider. Changing the strategy we use with OmniAuth can make this more obvious. We currently have implemented the OAuth2 strategy for Identity and extended it to take advantage of the OIDC logout feature. Switching to an OIDC strategy makes it more obvious what features the Identity service provides. It also, hopefully, makes things clearer for any future maintainer of the code.
felixclack
force-pushed
the
identity-oidc
branch
from
136e9a8
to
c99759f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The Identity service is an OpenID Connect provider. Changing the
strategy we use with OmniAuth can make this more obvious.
We currently have implemented the OAuth2 strategy for Identity and
extended it to take advantage of the OIDC logout feature.
Switching to an OIDC strategy makes it more obvious what features the
Identity service provides. It also, hopefully, makes things clearer for
any future maintainer of the code.
Link to Trello card
https://trello.com/c/85JumIaw/1090-switch-quals-to-use-an-oidc-strategy-for-identity
Checklist