Reconfigure core and ingest UI to use HCA auth0

[simonjupp]

• Reconfigure core to use the HCA auth0 instead of Daniel's
• Reconfigure UI to use the HCA auth0 as well

[justincc]

DCP DEMO on Tues 2018-12-04: Wranglers logging into in through UI to DCP auth. Only whitelisted users can access the system. Show that API is secured in the same way.

[justincc]

Needs to be done imminently since warnings are appearing on @danielvaughan 's free account

[justincc]

Per discussion with @aaclan-ebi this is not straightforward. We have been using the OAuth2.0 implicit grant up to now since ingest UI is a pure browser-side Angular app, and so can't be trusted with client_secret.

However, it looks like DCP Auth requires use of OAuth 2.0 authorization code grant which gives out the client secret.

Interestingly the demo code section in the DCP auth doc says that client_secret can be made available publicly. I find this surprising in light of the above. @Bento007 please could you explain how this works?

[1] https://auth0.com/docs/api-auth/grant/implicit
[2] https://allspark.dev.data.humancellatlas.org/dcp-ops/docs/wikis/Security/Authentication%20and%20Authorization/Setting%20up%20DCP%20Auth
[3] https://auth0.com/docs/api-auth/tutorials/authorization-code-grant

[aaclan-ebi]

Regardless of grant we need to implement, @Bento007 could we request for a client id for the Ingest UI?

• add Ingest UI as application in Auth0 (Single Page Application)
• add the following as Allowed Callback URLs

http://localhost:4200/callback
http://ui.ingest.dev.data.humancellatlas.org/callback
https://ui.ingest.dev.data.humancellatlas.org/callback
http://ui.ingest.integration.data.humancellatlas.org/callback
https://ui.ingest.integration.data.humancellatlas.org/callback
http://ui.ingest.staging.data.humancellatlas.org/callback
https://ui.ingest.staging.data.humancellatlas.org/callback
http://ui.ingest.data.humancellatlas.org/callback
https://ui.ingest.data.humancellatlas.org/callback

[Bento007]

We are currently managing auth0 using auth0-deploy-cli. You can modify the configuration here https://github.com/HumanCellAtlas/dcp-infra/tree/master/auth0

[Bento007]

The client IDs and secrets are used to identify the application origin of the request. It not being used for secrecy. You should be able to use the https://auth.dev.data.humancellatlas.org/ to retrieve an access token for your webapp.

[justincc]

Need a Google Service Account for DCP integration test to authenticate with ingest now. Going to ask for this in the tech arch meeting on 2019-01-03

[justincc]

Possible blocker is that dcp-diag may also need to update for change in the auth0 endpoint. I hear that you were going to look at this @sampierson?

[sampierson]

Yes @justincc , dcp-diag uses the same kind of IngestAuthAgent code that the integration tests do.

Also if we are to switch Upload from connecting directly to RabbitMQ and use an API instead, Upload will need this code in future.

[justincc]

The upload API endpoints are covered under upload-service#245. Can I create a similar ticket in dcp-diag so I don't lose track?

[sampierson]

Yes, please do. Thanks!

[justincc]

HumanCellAtlas/dcp-diag#8

[justincc]

UI changes or alternative covered in #285

[aaclan-ebi]

Changes are pushed to production. https://github.com/HumanCellAtlas/ingest-kube-deployment/blob/master/production/changelog.md#29-january-2019