feat: support multiple firebase audiences #264
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Terraform Dev EnvironmentTerraform Format and Style 🖌
|
Terraform Feature Environment (dev-264)Terraform Initialization ⚙️
|
volovyks
reviewed
Aug 16, 2023
There was a problem hiding this comment.
We can not just stop checking aud value. That is a crucial part of the Id Token. By merging the current implementation of the multi-project support we are opening a huge vector for attacks. Id Token from another project with the same user Id can get access to the key.
Instead, as we agreed at the meeting, we should whitelist supported Projects by whitelisting their aud's.
I was proposing to introduce a struct that will represent a partner. It can include aud, relayer URL, and relayer API key. The only thing that is important for this PR is aud, other parameters can be added with #249
As we discussed, it's better to keep the list of structs that represent partners outside of our codebase. Probably in terraform config.
Another important thing that we should keep in mind is that accounts for different partners should be completely separate even if the user uses the same Email. In practice, it means, that the internal_acc_id formula should be changed from iss:sub to iss:aud:sub. This should ensure that our service returns different keys for different projects for the same email (user). Since we already have the old iss:sub Pagoda project account, the internal_acc_id for them should remain the same.
|
I was under the assumption that this would be safe since the decoding key we retrieve does a signature check on the part of the OIDC token which includes the audience as well. Does this not suffice or do we need to add in an additional check via the whitelisted audiences config? The decoding keys are from |
|
discussed with @volovyks, in summary:
|
ChaoticTempest
force-pushed
the
phuong/feat/multi-firebase
branch
from
8a2ab84 to
a3f7953
Compare
ChaoticTempest
force-pushed
the
phuong/feat/multi-firebase
branch
from
a3f7953 to
61da02e
Compare
|
hopefully my makeshift work of terraform works out |
itegulov
reviewed
Aug 18, 2023
|
@itegulov let's just say I have no idea what I'm doing with all this terraform stuff. I'll try to fix all those, but was just trying to fit it in with what we had before with a singular audience id |
|
Also, let's add another firebase to allowlist here just to make sure that it works as expected on the feature environment |
volovyks
reviewed
Sep 4, 2023
infra/main.tf
Outdated
| node_id = count.index | ||
| firebase_audience_id = var.firebase_audience_id | ||
| node_id = count.index | ||
| allowlist = var.allowlist |
There was a problem hiding this comment.
probably needs to be something like "partners", "partners_list" or "partners_allowlist"
infra/modules/leader/main.tf
Outdated
| @@ -16,6 +16,24 @@ resource "google_secret_manager_secret_iam_member" "account_creator_secret_acces | |||
| member = "serviceAccount:${var.service_account_email}" | |||
| } | |||
|
|
|||
| resource "google_secret_manager_secret" "allowlist" { | |||
There was a problem hiding this comment.
Are we trying to store the partner list in secret manager here?
There was a problem hiding this comment.
yup, I thought that's what we discussed we'd do? I wouldn't know where else we'd store it, and doing it from terraform where we can potentially inject it would be best with defaults. Alternatively, in the future, we can just have a smart contract that stores all this metadata
| use serde::{Deserialize, Serialize}; | ||
|
|
||
| #[derive(Clone, Debug, Serialize, Deserialize, Hash, PartialEq, Eq)] | ||
| pub struct Entry { |
There was a problem hiding this comment.
The name seems a bit generic. Maybe "Partner"?
There was a problem hiding this comment.
I feel like Partner would make it too pagoda-centric. Probably OidcProvider would be better
| } | ||
|
|
||
| #[derive(Clone, Debug, Default, Serialize, Deserialize)] | ||
| pub struct AllowList { |
There was a problem hiding this comment.
Same here. Allowlist of what? :)
ChaoticTempest
force-pushed
the
phuong/feat/multi-firebase
branch
from
7ded17f to
49287d4
Compare
itegulov
approved these changes
Sep 5, 2023
|
Nice work @ChaoticTempest ! |
Terraform Feature Environment Destroy (dev-264)Terraform Initialization ⚙️
|
volovyks
reviewed
Sep 11, 2023
There was a problem hiding this comment.
Trying to understand better how our env variables work. Probably it's better to hop on the call. cc @itegulov @ChaoticTempest
| "issuer": format!("https://securetoken.google.com/{firebase_audience_id}"), | ||
| "audience": firebase_audience_id, | ||
| }, | ||
| ]) |
There was a problem hiding this comment.
And this is only for tests? I'm struggling to understand how it's set in prod, especially when we will have api_keys in the same struct.
There was a problem hiding this comment.
this info is being passed via the CLI. For prod, it should be taken from secrets manager. If not set, the command in DEPLOY.md will just use the default audience we already have in prod in the current state
| &gcp_service, | ||
| &env, | ||
| "leader", | ||
| oidc_providers, |
There was a problem hiding this comment.
Why are we passing oidc_providers and getting them back here?:)
There was a problem hiding this comment.
This is just the pattern we've been using for loading these parameters from secrets manager in the case that they are None
|
One more:
|
|
@ChaoticTempest thank you for all the answers! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
addresses #251
the OIDC token already has the audience, so this PR just moves towards having only the OIDC token be a part of the verification. This should allow us to do multiple firebase audiences as the only thing preventing us before was the verification step of the token.
We don't use the audience value anywhere else, so just added a deprecation warning to the CLI flag as well.