As a super user, I would like my access to the admin dashboard protected by two-factor authentication

[alexsoble]

Description:

From the RFQ:

The software must have multi-factor authentication for the grantees and PIV authorization for the OFA staff and key personnel. The Login.gov system has already been procured to fulfill this requirement.

https://github.com/18F/tdrs-app-rfq/blob/main/Final-RFQ/FINAL-TDRS-software-development-RFQ.md#32-quality-assurance-surveillance-plan-qasp

Notes:

• This could be accomplished by putting the Django Admin page behind the same Login.gov two-factor flow as the rest of the app. Alternatively, the app could have separate authentication flows for the frontend app and the Django Admin page, both with separate two factor authentication implementation.

Acceptance Criteria:

• Django Admin page protected by two factor authentication
• Leverage login.gov MFA for authentication to the admin site
• Only users with staff can open the admin console
• Only users with superuser can read/update data in the admin console
• The Admin login page redirects to login.gov

Tasks:

• Add BE login url to the settings
• Force authentication to the admin login page (which will redirect it to the correct login)

[alexsoble]

I did a little research into our options here -- I think putting the Django admin dashboard behind the same Login.gov flow as the rest of the app would be a good strategy for a few reasons:

1. Using Login.gov for Django Admin would allow use of PIV cards to authenticate.
2. Using PIV cards would give us an AAL3 assurance level for the entire app. If we don't use Login for the Django Amin dashboard, we'll have part of the app protected at AAL3 and part of the app protected at AAL2.
3. If we don't use Login for the Django Admin dashboard, we'll have to maintain and secure two separate auth systems.

@carltonsmith As reference points for implementation:

• Here's an article on how to customize auth for Django Admin: https://medium.com/walmartglobaltech/pluging-in-additional-auth-mechanism-to-django-admin-login-ae22d0bd0da1

• Here's an 18F project with USDOJ uses Django Admin + a custom auth flow: https://github.com/usdoj-crt/crt-portal

[carltonsmith]

Thanks, I'll check out the articles and let you know what I think

[carltonsmith]

Since we've determined the admin is using the login.gov authentication, I am updating the AC's accordingly. Please revise if needed @lfrohlich @alexsoble

[alexsoble]

Thanks for updating those ACs @carltonsmith! They look good to me but I'd ask -- could we frame some of them as evil user stories, so that we can more explicitly spell out what an evil user might try to do and how we can verify that they can't do it?

[lfrohlich]

Per @alexsoble 's review, I'm pushing this back to "in progress" for tests to be added