Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add BlockingFunctionsConfig, AuthorizedDomains and QuotaConfig fields to identityplatform config #8064

Closed
wants to merge 15 commits into from
Closed

Add BlockingFunctionsConfig, AuthorizedDomains and QuotaConfig fields to identityplatform config #8064

Show file tree
Hide file tree
Changes from 14 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
8bf778d
Add blocking_functions and quota fields to ProjectDefaultConfig
mraouffouad Jun 1, 2023
9d39b25
Merge branch 'GoogleCloudPlatform:main' into gcip_config
mraouffouad Jun 1, 2023
c878e1d
Add recaptchaConfig to ProjectDefaultConfig
mraouffouad Jun 1, 2023
f6f01ef
Update ProjectDefaultConfig.yaml
mraouffouad Jun 1, 2023
f6ecf21
Merge branch 'GoogleCloudPlatform:main' into gcip_config
mraouffouad Jun 1, 2023
e42e09c
Remove recaptchaVonfig field and add authorizedDomains.
mraouffouad Jun 26, 2023
fd61722
Add the missing key_name
mraouffouad Jun 28, 2023
18ffc06
Merge branch 'GoogleCloudPlatform:main' into gcip_config
mraouffouad Jun 28, 2023
5f3c9cd
Remove trailing spaces
mraouffouad Jun 28, 2023
32d2d57
Remove trailing space (attempt 2).
mraouffouad Jun 28, 2023
ebde1f9
add example template
mraouffouad Jul 3, 2023
fe10482
fix authorized domain examples
mraouffouad Jul 4, 2023
f8ac631
add some missing fields to the test template
mraouffouad Jul 9, 2023
a961578
marking some fields as required and using more realistic values for a…
mraouffouad Jul 12, 2023
c92229e
Update identity_platform_project_default_config.tf.erb
mraouffouad Jul 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions mmv1/products/identityplatform/ProjectDefaultConfig.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,3 +124,71 @@ properties:
output: true
description: |
Memory cost for hash calculation. Used by scrypt and other similar password derivation algorithms. See https://tools.ietf.org/html/rfc7914 for explanation of field.

- !ruby/object:Api::Type::NestedObject
name: 'blockingFunctions'
description: |
Configuration related to blocking functions.
properties:
- !ruby/object:Api::Type::Map
name: 'triggers'
roaks3 marked this conversation as resolved.
Show resolved Hide resolved
required: true
description: |
Map of Trigger to event type. Key should be one of the supported event types: "beforeCreate", "beforeSignIn".
key_name: event_type
value_type: !ruby/object:Api::Type::NestedObject
properties:
- !ruby/object:Api::Type::String
name: 'functionUri'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would it make sense for this to be a resource reference to https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloudfunctions_function instead of a pure string?

In theory we could accommodate someone that uses Terraform for Auth but not Functions, but do we expect that to be a common use-case?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would defer this to the reviewer to weigh in.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Possibly, but there is currently some work being done with ResourceRef to get it working the way we want, and we are advising teams to avoid adding them for now. (see #8127)

Unrelated, but setting a function_uri within the map value seems like it should be required.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep. Done.

required: true
description: |
HTTP URI trigger for the Cloud Function.
- !ruby/object:Api::Type::Time
name: 'updateTime'
output: true
description: |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this also be output only?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

When the trigger was changed.
- !ruby/object:Api::Type::NestedObject
name: 'forwardInboundCredentials'
description: |
The user credentials to include in the JWT payload that is sent to the registered Blocking Functions.
properties:
- !ruby/object:Api::Type::Boolean
name: 'idToken'
description: |
Whether to pass the user's OIDC identity provider's ID token.
- !ruby/object:Api::Type::Boolean
name: 'accessToken'
description: |
Whether to pass the user's OAuth identity provider's access token.
- !ruby/object:Api::Type::Boolean
name: 'refreshToken'
description: |
Whether to pass the user's OAuth identity provider's refresh token.
- !ruby/object:Api::Type::NestedObject
name: 'quota'
description: |
Configuration related to quotas.
properties:
- !ruby/object:Api::Type::NestedObject
name: 'signUpQuotaConfig'
description: |
Quota for the Signup endpoint, if overwritten. Signup quota is measured in sign ups per project per hour per IP.
properties:
- !ruby/object:Api::Type::Integer
name: 'quota'
description: |
Corresponds to the 'refill_token_count' field in QuotaServer config.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Honest question because I'm not caught up on your exact use case: is this a user-friendly description?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was this addressed?

- !ruby/object:Api::Type::Time
name: 'startTime'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto !ruby/object:Api::Type::Time

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

description: |
When this quota will take affect.
- !ruby/object:Api::Type::String
name: 'quotaDuration'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a string based on https://cloud.google.com/identity-platform/docs/reference/rest/v2/Config#TemporaryQuota

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

description: |
How long this quota will be active for.
- !ruby/object:Api::Type::Array
name: authorizedDomains
description: |
List of domains authorized for OAuth redirects.
item_type: Api::Type::String
28 changes: 27 additions & 1 deletion mmv1/templates/terraform/examples/identity_platform_project_default_config.tf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,30 @@ resource "google_identity_platform_project_default_config" "<%= ctx[:primary_res
}
}
}
}

blocking_functions {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Due to hashicorp/terraform-provider-google#13327, tests are currently disabled on this resource. In short, the initial apply (and later the destroy) that is done during tests will clear out other settings on the project.

I think there are two main directions you can go from here:

  1. Keep the changes where they are, but keep in mind that this bug is unresolved, so your users may experience difficulties. You can attempt to resolve the bug if you choose, which would help make these new features more usable. For testing, you will need to turn off skip_test locally, and run the test in your own environment to ensure things are working.
  2. Move the changes to identityplatform/Config.yaml, which appears to use the same endpoint but without this bug. For testing, you could probably remove the skip_vcr: true so that they run in the PR, otherwise you will need to run the test in your own environment.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure this was addressed either. It seems like you're choosing to keep the changes in this resource (cc @tylerg-dev who I see is a reviewer and also authored identityplatform/Config.yaml #6587).

Either way, you will need to provide some sort of proof (ie. output) from running the acceptance tests.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't see why we'd have a duplicate at all? this one has more fields, but those should have just been merged into the initially added resource.
At this point do we have a way to combine them back together (and properly use field-masks to avoid the bug listed above)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, the second resources was added with #6679, and I believe it was created due to a miscommunication combined with unfortunate timing. Since users could be using the newer resource, we cannot simply remove or merge it, but we could choose to start down the deprecation process and remove it in the next major release.

Ideally, I think the fields on this resource should be moved to yours, and this resource removed.

triggers {
"beforeSignIn" = {
function_uri = "new_uri-before-sign-in"
}
}

forward_inbound_credentials {
refresh_token = true
access_token = true
id_token = true
}
}

quota {
sign_up_quota_config {
quota = 1000
}
}

authorized_domains = [
"localhost",
"project_id.firebaseapp.com",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking more of doing it properly, like "<%= ctx[:vars]['project_id'] %>", or actually put in a data source and reference.

"project_id.web.app",
]
}