Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

authn: Generalize support to ~any OIDC/OAuth2 IdP, not just AWS Cognito #731

Merged
merged 2 commits into from
Oct 18, 2023
Merged

authn: Generalize support to ~any OIDC/OAuth2 IdP, not just AWS Cognito #731

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
582856c
authn: Generalize support to ~any OIDC/OAuth2 IdP, not just AWS Cognito
tsibley Jul 29, 2023
e84c672
authn: Support IdPs that backdate their "iat" claim in id tokens
tsibley Oct 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions aws/cognito/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,21 @@ output "COGNITO_USER_POOL_ID" {
value = aws_cognito_user_pool.nextstrain_dot_org.id
}

output "COGNITO_BASE_URL" {
value = format("https://%s", coalesce(
one(aws_cognito_user_pool_domain.custom[*].domain),
"${aws_cognito_user_pool_domain.cognito.domain}.auth.${split("_", aws_cognito_user_pool.nextstrain_dot_org.id)[0]}.amazoncognito.com",
))
output "OIDC_IDP_URL" {
value = format("https://%s", aws_cognito_user_pool.nextstrain_dot_org.endpoint)
}

output "COGNITO_CLIENT_ID" {
output "OAUTH2_CLIENT_ID" {
value = aws_cognito_user_pool_client.nextstrain_dot_org.id
}

output "COGNITO_CLI_CLIENT_ID" {
output "OAUTH2_CLI_CLIENT_ID" {
value = aws_cognito_user_pool_client.nextstrain-cli.id
}

output "OAUTH2_LOGOUT_URL" {
value = format("https://%s/logout", coalesce(
one(aws_cognito_user_pool_domain.custom[*].domain),
"${aws_cognito_user_pool_domain.cognito.domain}.auth.${split("_", aws_cognito_user_pool.nextstrain_dot_org.id)[0]}.amazoncognito.com",
))
}
20 changes: 15 additions & 5 deletions docs/infrastructure.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,13 +72,23 @@ Several variables are required but obtain defaults from a config file (e.g. `env

- `COGNITO_USER_POOL_ID` must be set to the id of the Cognito user pool to use for authentication.

- `COGNITO_BASE_URL` must be set to the URL of the Cognito user pool's hosted UI.
In production, this is `https://login.nextstrain.org`.
In development and testing, this would be something like `https://nextstrain-testing.auth.us-east-1.amazoncognito.com`.
- `OIDC_IDP_URL` must be set to the URL of the Cognito user pool's IdP endpoint.
This is something like `https://cognito-idp.{REGION}.amazonaws.com/{REGION}_{ID}`.

- `COGNITO_CLIENT_ID` must be set to the OAuth2 client id for the nextstrain.org client registered with the Cognito user pool.
- `OAUTH2_CLIENT_ID` must be set to the OAuth2 client id for the nextstrain.org client registered with the Cognito user pool.

- `COGNITO_CLI_CLIENT_ID` must be set to the OAuth2 client id for the Nextstrain CLI client registered with the Cognito user pool.
- `OAUTH2_CLI_CLIENT_ID` must be set to the OAuth2 client id for the Nextstrain CLI client registered with the Cognito user pool.

- `OAUTH2_LOGOUT_URL` overrides any value discovered via IdP metadata.
For Cognito, which doesn't provide a value via metadata, this must be set to the logout URL of the Cognito user pool's hosted UI.
In production, this is `https://login.nextstrain.org/logout`.
In development and testing, this would be something like `https://nextstrain-testing.auth.us-east-1.amazoncognito.com/logout`.

- `OIDC_USERNAME_CLAIM` must be set to the field in the id token claims which contains the username for a user.
For Cognito, this is `cognito:username`.

- `OIDC_GROUPS_CLAIM` must be set to the field in the id token claims which contains the list of group names for a user.
For Cognito, this is `cognito:groups`.

Variables in the environment override defaults from the config file.

Expand Down
9 changes: 6 additions & 3 deletions docs/terraform.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,10 +262,13 @@ Each configuration provides outputs of key-value pairs corresponding to
environment (or config) variables required by the nextstrain.org server::

$ terraform output
COGNITO_BASE_URL=https://login.nextstrain.org
COGNITO_CLIENT_ID=rki99ml8g2jb9sm1qcq9oi5n
COGNITO_CLI_CLIENT_ID=2vmc93kj4fiul8uv40uqge93m5
COGNITO_USER_POOL_ID=us-east-1_Cg5rcTged
OIDC_IDP_URL=https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Cg5rcTged
OAUTH2_CLIENT_ID=rki99ml8g2jb9sm1qcq9oi5n
OAUTH2_CLI_CLIENT_ID=2vmc93kj4fiul8uv40uqge93m5
OAUTH2_LOGOUT_URL=https://login.nextstrain.org/logout
OIDC_USERNAME_CLAIM=cognito:username
OIDC_GROUPS_CLAIM=cognito:groups

Outputs are stored and tracked in the remote state and may be updated when
applying configuration changes. We cache non-sensitive outputs in JSON config
Expand Down
24 changes: 18 additions & 6 deletions env/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,26 @@ output "COGNITO_USER_POOL_ID" {
value = module.cognito.COGNITO_USER_POOL_ID
}

output "COGNITO_BASE_URL" {
value = module.cognito.COGNITO_BASE_URL
output "OIDC_IDP_URL" {
value = module.cognito.OIDC_IDP_URL
}

output "COGNITO_CLIENT_ID" {
value = module.cognito.COGNITO_CLIENT_ID
output "OAUTH2_CLIENT_ID" {
value = module.cognito.OAUTH2_CLIENT_ID
}

output "COGNITO_CLI_CLIENT_ID" {
value = module.cognito.COGNITO_CLI_CLIENT_ID
output "OAUTH2_CLI_CLIENT_ID" {
value = module.cognito.OAUTH2_CLI_CLIENT_ID
}

output "OAUTH2_LOGOUT_URL" {
value = module.cognito.OAUTH2_LOGOUT_URL
}

output "OIDC_USERNAME_CLAIM" {
value = "cognito:username"
}

output "OIDC_GROUPS_CLAIM" {
value = "cognito:groups"
}
11 changes: 7 additions & 4 deletions env/production/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
{
"COGNITO_BASE_URL": "https://login.nextstrain.org",
"COGNITO_CLIENT_ID": "rki99ml8g2jb9sm1qcq9oi5n",
"COGNITO_CLI_CLIENT_ID": "2vmc93kj4fiul8uv40uqge93m5",
"COGNITO_USER_POOL_ID": "us-east-1_Cg5rcTged"
"OIDC_IDP_URL": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Cg5rcTged",
"OAUTH2_CLIENT_ID": "rki99ml8g2jb9sm1qcq9oi5n",
"OAUTH2_CLI_CLIENT_ID": "2vmc93kj4fiul8uv40uqge93m5",
"OAUTH2_LOGOUT_URL": "https://login.nextstrain.org/logout",
"COGNITO_USER_POOL_ID": "us-east-1_Cg5rcTged",
"OIDC_USERNAME_CLAIM": "cognito:username",
"OIDC_GROUPS_CLAIM": "cognito:groups"
}
11 changes: 7 additions & 4 deletions env/testing/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
{
"COGNITO_BASE_URL": "https://nextstrain-testing.auth.us-east-1.amazoncognito.com",
"COGNITO_CLIENT_ID": "6qiojrhr8tibt0f6hphnm1osp1",
"COGNITO_CLI_CLIENT_ID": "9opa27o74f4jsq8g4a34e1mqr",
"COGNITO_USER_POOL_ID": "us-east-1_zqpCrjM7I"
"OIDC_IDP_URL": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_zqpCrjM7I",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's interesting how in AWS, there is a clear distinction between IAM users/groups and Cognito users/groups, while in Azure with the current setup, it's all under AAD. I wonder if this has implications for organizations that manages Azure resources with AAD users.

Did you look into something like Azure AD B2C? I haven't used it personally, but it looks to be quite different from AAD, made clearer by name with the recent rebranding.

I'm asking these questions, but I don't think we should ponder too much because this seems to be working well for CDC's use case.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't look into Azure AD B2C, but looking now, yes, it's much more akin to Cognito. e.g. conceptually we could swap out our usage of Cognito for Azure AD B2C, but we wouldn't swap Cognito for Azure AD/Entra ID.

In CDC's case, they want to use their existing user directory in Azure AD and since they're also hosting the application themselves, it's simplest to authenticate against Azure AD directly. While they could set up an Azure AD B2C instance just for this app and then invite specific users from their Azure AD into their Azure AD B2C, it would just be more layers of indirection for not any functional gain. The gain would be more administrative/organizational, e.g. if for some reason they didn't want to directly authn against Azure AD or if they wanted a harder adminstrative split.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe to sum that up: There's a lot of ways to do user directories for authn purposes, but no one right way; it's highly dependent on the needs/context/where the users already are.

"OAUTH2_CLIENT_ID": "6qiojrhr8tibt0f6hphnm1osp1",
"OAUTH2_CLI_CLIENT_ID": "9opa27o74f4jsq8g4a34e1mqr",
"OAUTH2_LOGOUT_URL": "https://nextstrain-testing.auth.us-east-1.amazoncognito.com/logout",
"COGNITO_USER_POOL_ID": "us-east-1_zqpCrjM7I",
"OIDC_USERNAME_CLAIM": "cognito:username",
"OIDC_GROUPS_CLAIM": "cognito:groups"
}
Loading
Loading