Extended authentication and UI for #617

[mxsasha]

Work on #617 will take place here for now. Some ongoing notes:

Larger tasks

• More useful index page
• 2FA
• [ ] API keys out of scope for this PR
• User signup
• Command to set override perm (mandatory MFA)
• Password recovery
• User detail page cleanup
• Some password requirements
• 2FA recovery
• Logs (especially any authentication/token failures)
• Tests
• Docs
• Copy/content
• Extract hostname / RP ID to config
• Final review

Post merge

• Package updates, including making sure we're not affected by GHSA-74m5-2c7w-9w3x
• Update wtforms_bootstrap5 dependency after Remove dict union operator for 3.8 compatibility LaunchPlatform/wtforms-bootstrap5#5 is merged and released.

Minor things

• Shorten password reset validity
• Log irrdctl auth changes
• Check wtforms_bootstrap5 dependency.
• send_authentication_change_mail isn't actually called for 2FA
• Send change mail also for 2FA clear.
• Move session provider decorators eksewhere
• Check copy index
• Rename user_detail
• Remove audit log model for now, out of scope
• Fix migration email workflow and update copy
• Feature to disable newauth
• Rate limit all requests to reset_password_request and create_account
• Check TODOs
• Fix md5 vs bcrypt tests/live
• Clean up the irrd_database fixtures
• Split the commits before merge
• FIx missing 2FA redirect after login
• Warn about 2FA disabled for override users
• Make sure we still log HTTP requests (Reduce uvicorn log filter #757)
• Mail user on 2FA changes
• Verify totp_past_used
• StarletteForm already include Form inheritance
• Submit_update does not check 2FA
• Horizontal forms? And consistency in floats.
• Improve timestamp display
• Finish migration flow by actually making email
• Send out emails, probably from render_email
• Indicate to user when they have perms on a maintainer for which migration is not yet completed
• Protect rpsl_update wth CSRF
• Offload ChangeSubmissionHandler to a thread in rpsl_update
• Clean up token generation/validation
• authentication_required should do proper redirect
• Probably require password for changing permissions of others
• Make sure users don't accidentally remove themselves from mntners
• Clean up wtforms-bootstrap5 dependency
• Internal secret key management (pw token, middleware, CSRF, LoginManager)
• Don't allow mntners to be authentication-less?
• Support for checking migrated legacy methods in AuthValidator
• Web interface for lookups should filter hashes except when authed
• Interface for managing legacy methods
• Password hashing for user logins
• Messages from starlette-core here and here
• Password change
• Name or email change
• Rate limiting
• Will migrate trigger notification of object change? It should.
• Object change notification for added/removed mntners
• Is IRRD_INTERNAL_AUTH correctly added on migration?
• mntner notify sent for rpsl_form view?
• Fix trailing slashes in URLs

Restructures/refactors

• New database interaction needs a bit better architecture
• Consider moving parts of mntner_migrate_complete to RPSLMntner?
• Extract common parts of SP forms
• Look into extracting some common ORM queries
• Rename/extract module auth into webui
• Find good places for everything currently in utils and init
• Include CSS dependencies
• Extract/include JS
• Docstrings where appropriate
• Extract setting for rate limit?
• Resolve circular imports

[mxsasha]

From #617

During migration, existing authentication methods are migrated as well, so that existing integrations continue working. They will be removed from the object in the IRR database and moved to IRRD’s authentication store.

This not actually a practical idea, because it would be difficult for users to manage these hashes - IRRD doesn't have any context to offer. I think a better approach is similar to what RIPE does here: keep the legacy methods in place as is, and also show the full hashes to authenticated users with mntner permissions.

First part of that is in 8d027d1, second in 42e86e4. Maybe we should not allow new legacy methods to be added to migrated mntners? Or allow restricting that.

Sidenote: RIPE lists all SSO accounts as SSO auth lines in mntner, we are not doing that - there is a magic auth attribute that indicates the mntner is migrated, and the rest is in the auth database.

[fischerdouglas]

Hello!
It is visible that the scope of this activity already is not easy or small.

But I'l seize the opportunity and ping one more time about OAuth2/SAML.

PeeringDB already supports this method. And I hear about similar movements from RIRs.

Thanks!