Upgrade to Panda v7 - support key rotation #81

rtyley · 2024-08-08T13:55:47Z

This upgrades Panda from v5 to v7, allowing us to perform key rotation.

As login.gutools.co.uk is pretty special user of Panda, the upgrade is slightly more involved than other upgrades (eg guardian/atom-workshop#361):

Panda v6:
- Refactor Cookie generation-&-parsing pan-domain-authentication#152 means the CookieUtils.generateCookieData() method now communicates errors with CookieResult values containing CookieIntegrityFailure, rather than exceptions.
- Refactor Settings loading-&-parsing pan-domain-authentication#151 introduced the new S3BucketLoader abstraction, which simplifies constructing a PanDomainAuthSettingsRefresher and means that Panda is no longer tied to AWS SDK v1 - an alternative AWS SDK v2 implementation of S3BucketLoader could be introduced.
Panda v7:
- Support accepting multiple public keys pan-domain-authentication#150 means that code shouldn't directly reference private or public keys anymore (eg do not reference settings.signingKeyPair). Instead, use settings.signingAndVerification or publicSettings.verification. Note also that publicSettings.publicKey was previously optional, and publicSettings.verification is not.

This PR sits on top of:

Update to Panda v5 #82

rtyley · 2024-09-18T10:58:50Z

app/controllers/DesktopLogin.scala

@@ -64,7 +64,7 @@ class DesktopLogin(


      if (validateUser(authedUserData)) {
-        val token = CookieUtils.generateCookieData(authedUserData, panDomainSettings.settings.signingKeyPair.getPrivate)
+        val token = CookieUtils.generateCookieData(authedUserData, panDomainSettings.settings.signingAndVerification)


guardian/pan-domain-authentication#150 means that code shouldn't directly reference private or public keys anymore (eg do not reference settings.signingKeyPair- there may be more accepted public keys than that field would have told you about!). Instead, we need to use settings.signingAndVerification or publicSettings.verification.

rtyley · 2024-09-18T11:03:16Z

app/controllers/Emergency.scala

@@ -30,27 +30,16 @@ class Emergency(
    val reissueTopic = "Your login session has not been extended"

    (for {
-      publicKey <- loginPublicSettings.publicKey


Note that publicSettings.publicKey was previously optional (although that ended with guardian/pan-domain-authentication#151 in Panda v6), and publicSettings.verification (introduced with guardian/pan-domain-authentication#150 in Panda v7) is not optional.

rtyley · 2024-09-18T11:05:22Z

app/controllers/Emergency.scala

+    } yield CookieUtils.parseCookieData(assymCookie.value, loginPublicSettings.verification).fold(
+      tokenIntegrityFailure =>
+        unauthorised(s"Invalid existing session, could not log you in: $tokenIntegrityFailure", reissueTopic)
+      , authenticatedUser =>
        if (validateUser(authenticatedUser)) {
-          val expires = (DateTime.now() + cookieLifetime).getMillis
-          val newAuthUser = authenticatedUser.copy(expires = expires)
-          val authCookie = generateCookie(newAuthUser)
+          val authCookie = generateCookie(authenticatedUser.copy(expires = (DateTime.now() + cookieLifetime).getMillis))
          Ok(views.html.emergency.reissueSuccess()).withCookies(authCookie)
-        } else {
-          unauthorised("Only Guardian email addresses with two-factor auth are supported.", reissueTopic)
-        }
-      }
-      catch {
-        case _: CookieSignatureInvalidException =>
-          unauthorised("Invalid existing session, could not log you in.", reissueTopic)
-        case _: CookieParseException =>
-          unauthorised("Could not refresh existing session due to a corrupted cookie.", reissueTopic)


CookieUtils.generateCookieData() now communicates errors with CookieResult values containing a CookieIntegrityFailure, rather than exceptions, thanks to guardian/pan-domain-authentication#152 in Panda v6.

This upgrades Panda from v5 to v7, allowing us to use key rotation as introduced with guardian/pan-domain-authentication#150. As login.gutools.co.uk is pretty special user of Panda the upgrade is slightly more involved than other upgrades (eg guardian/atom-workshop#361): * Panda v6: * guardian/pan-domain-authentication#152 `CookieUtils.generateCookieData()` now communicates errors with `CookieResult` values containing `CookieIntegrityFailure`, rather than exceptions. * Panda v7: * guardian/pan-domain-authentication#150 means that code shouldn't directly reference private or public keys anymore (eg do not reference `settings.signingKeyPair`). Instead, use `settings.signingAndVerification` or `publicSettings.verification`. Note also that `publicSettings.publicKey` was previously optional, and `publicSettings.verification` is not.

rtyley · 2024-09-20T10:12:16Z

app/AppComponents.scala

-  private lazy val panDomainSettings: PanDomainAuthSettingsRefresher =
-    new PanDomainAuthSettingsRefresher(
-      domain = config.domain,
-      system = "login",
-      bucketName = config.pandaAuthBucket,
-      settingsFileKey = s"${config.domain}.settings",
-      s3Client = aws.s3Client
-    )
-
-  private lazy val desktopPanDomainSettings: PanDomainAuthSettingsRefresher = {
-    new PanDomainAuthSettingsRefresher(
-      domain = config.desktopDomain,
-      system = "login-desktop",
-      bucketName = config.pandaAuthBucket,
-      settingsFileKey = s"${config.desktopDomain}.settings",
-      s3Client = aws.s3Client
-    )
-  }
-
-  val loginPublicSettings = new PublicSettings(
-    settingsFileKey = s"${config.domain}.settings.public",
-    bucketName = config.pandaAuthBucket,
-    s3Client = aws.s3Client
+  private val s3BucketLoader: S3BucketLoader = forAwsSdkV1(aws.s3Client, "pan-domain-auth-settings")
+
+  private lazy val panDomainSettings: PanDomainAuthSettingsRefresher = PanDomainAuthSettingsRefresher(
+    domain = config.domain,
+    system = "login",
+    s3BucketLoader
+  )
+
+  private lazy val desktopPanDomainSettings: PanDomainAuthSettingsRefresher = PanDomainAuthSettingsRefresher(
+    domain = config.desktopDomain,
+    system = "login-desktop",
+    s3BucketLoader
+  )
+
+  val loginPublicSettings: PublicSettings = PublicSettings(
+    new Settings.Loader(s3BucketLoader, s"${config.domain}.settings.public")


This PR:

Refactor Settings loading-&-parsing pan-domain-authentication#151

...introduced the new S3BucketLoader abstraction, which simplifies constructing a PanDomainAuthSettingsRefresher and means that Panda is no longer tied to AWS SDK v1 - an alternative AWS SDK v2 implementation of S3BucketLoader could be introduced.

prout-bot · 2024-09-24T10:14:01Z

Seen on PROD (merged by @rtyley 5 minutes and 19 seconds ago) Please check your changes!

rtyley force-pushed the try-out-updated-panda-settings-code branch from d7da4a5 to 76a120e Compare August 8, 2024 14:05

rtyley mentioned this pull request Aug 8, 2024

Refactor Settings loading-&-parsing guardian/pan-domain-authentication#151

Merged

rtyley force-pushed the try-out-updated-panda-settings-code branch 2 times, most recently from 4498ee2 to cb88c40 Compare August 9, 2024 17:07

rtyley changed the base branch from main to upgrade-to-panda-v5 August 9, 2024 17:08

rtyley force-pushed the try-out-updated-panda-settings-code branch 2 times, most recently from 23f4377 to b1f7295 Compare August 9, 2024 17:17

rtyley mentioned this pull request Sep 4, 2024

Support accepting multiple public keys guardian/pan-domain-authentication#150

Merged

rtyley force-pushed the try-out-updated-panda-settings-code branch 2 times, most recently from 02039cd to 153b647 Compare September 4, 2024 14:47

rtyley force-pushed the try-out-updated-panda-settings-code branch 2 times, most recently from 715fddd to bc8b359 Compare September 13, 2024 11:54

rtyley changed the title ~~Try out updated Panda settings code~~ Upgrade to Panda v7 - support key rotation Sep 18, 2024

rtyley force-pushed the try-out-updated-panda-settings-code branch from bc8b359 to 8b3a015 Compare September 18, 2024 10:54

rtyley commented Sep 18, 2024

View reviewed changes

rtyley mentioned this pull request Sep 18, 2024

Upgrade Guardian services to Panda v7 - support key rotation guardian/pan-domain-authentication#160

Open

7 tasks

rtyley marked this pull request as ready for review September 19, 2024 10:03

rtyley force-pushed the try-out-updated-panda-settings-code branch from 8b3a015 to 881deca Compare September 19, 2024 15:06

rtyley commented Sep 20, 2024

View reviewed changes

Fweddi approved these changes Sep 20, 2024

View reviewed changes

Base automatically changed from upgrade-to-panda-v5 to main September 20, 2024 16:17

rtyley merged commit 8146c15 into main Sep 24, 2024
1 check passed

rtyley deleted the try-out-updated-panda-settings-code branch September 24, 2024 10:08

prout-bot added Pending-on-PROD Seen-on-PROD and removed Pending-on-PROD labels Sep 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade to Panda v7 - support key rotation #81

Upgrade to Panda v7 - support key rotation #81

rtyley commented Aug 8, 2024 •

edited

Loading

rtyley Sep 18, 2024

rtyley Sep 18, 2024 •

edited

Loading

rtyley Sep 18, 2024

rtyley Sep 20, 2024

prout-bot commented Sep 24, 2024

Upgrade to Panda v7 - support key rotation #81

Upgrade to Panda v7 - support key rotation #81

Conversation

rtyley commented Aug 8, 2024 • edited Loading

rtyley Sep 18, 2024

Choose a reason for hiding this comment

rtyley Sep 18, 2024 • edited Loading

Choose a reason for hiding this comment

rtyley Sep 18, 2024

Choose a reason for hiding this comment

rtyley Sep 20, 2024

Choose a reason for hiding this comment

prout-bot commented Sep 24, 2024

rtyley commented Aug 8, 2024 •

edited

Loading

rtyley Sep 18, 2024 •

edited

Loading