1056167 - Loop — Stage and Production wrong fxaAudience configuration

Status: VERIFIED FIXED

(Cloud Services :: Operations: Deployment Requests - DEPRECATED, task)

Description

[Rémy Hubscher (:natim)]

When testing 1045966 I realized that the fxaAudience configuration for loop-server on Stage and Production is probably wrong.

It should be:

For production: 

  "fxaAudiences": [
    "https://loop.services.mozilla.com",
    "app://loop.services.mozilla.com"
  ],

For stage:

  "fxaAudiences": [
    "https://loop.stage.mozaws.net",
    "app://loop.stage.mozaws.net"
  ],

Comment 1

[James Bonacci [:jbonacci]]

Using this bug as our proxy deployment bug for Loop-Server Stage and Prod...

Comment 2

[James Bonacci [:jbonacci]]

Checking the new instance in Stage now:

/data/loop-server/config/settings.json shows the following:
    "fxaAudiences": [
        "app://loop.stage.mozaws.net",
        "https://loop.stage.mozaws.net"
    ],



/etc/puppet/yaml/app/loop_server.stage.yaml shows the following:
...etc...
    # domain of website for fxa verification
    fxaAudiences: 
        - "https://loop.stage.mozaws.net"
    fxaVerifier: "https://verifier.stage.mozaws.net/v2"
    fxaTrustedIssuers: 
        - "auth.stage.mozaws.net"
...etc...
    fxaAudiences: 
        - "https://loop.stage.mozaws.net"
        - "app://loop.stage.mozaws.net"
    fxaVerifier: "https://verifier.stage.mozaws.net/v2"
    fxaTrustedIssuers: 
        - "api-accounts.stage.mozaws.net"
        - "msisdn-dev.stage.mozaws.net"


Should their be duplicate entries in this yaml?



/etc/puppet/yaml/app/loop_server.yaml shows the following:
    # fxaAudience should be the server's url
    fxaAudiences: 
        - "http://loop.services.mozilla.com"
        - "app://loop.services.mozilla.com"

As the "default", I expected these values, but please confirm.

Comment 3

[Bob Micheletto [:bobm]]

This configuration change has been pushed to Stage.  As long as the duplicates aren't hurting anything, I'll leave it as is, and wait for confirmation from :mostlygeek .

Comment 4

[James Bonacci [:jbonacci]]

OK, so assuming we are good, we can push to Prod tomorrow (Thu)...
Otherwise, let's fix the dupes in Stage.

Comment 5

[Rémy Hubscher (:natim)]

Great let me know when you are ready with it.

Comment 6

[Rémy Hubscher (:natim)]

On stage we are also missing the fxaTrustedIssuers configuration:

  fxaTrustedIssuers: ["api.accounts.firefox.com", "msisdn.stage.mozaws.net"]

Comment 7

[Rémy Hubscher (:natim)]

I am wondering if we don't want to put all of them on stage.

  fxaTrustedIssuers: ["api.accounts.firefox.com", "msisdn.stage.mozaws.net" , "msisdn-dev.stage.mozaws.net", "msisdn.services.mozilla.com"]

Comment 8

[James Bonacci [:jbonacci]]

Interesting idea. Should not hurt, but let's run it by OPs...

Comment 9

[Benson Wong [:mostlygeek]]

I don't see why not. It should be a quick config tweak.

Comment 10

[James Bonacci [:jbonacci]]

OK, I will wait for changes before hitting Stage over again.

Also - we should address this:
bug 1057090

Comment 11

[James Bonacci [:jbonacci]]

:bobm 
or
"mostlygeek

I need this to move forward for my testing.
Any ETA on the config changes for Stage?

Comment 12

[Bob Micheletto [:bobm]]

(In reply to James Bonacci [:jbonacci] from comment #11)
> :bobm 
> or
> "mostlygeek

Working on it.

Comment 13

[Bob Micheletto [:bobm]]

Audiences added in Puppet.  Okay to re-roll stage instance?

Comment 14

[James Bonacci [:jbonacci]]

:bobm yes please re-deploy Loop-Server Stage...

Comment 15

[Bob Micheletto [:bobm]]

(In reply to James Bonacci [:jbonacci] from comment #14)
> :bobm yes please re-deploy Loop-Server Stage...

Re-deploy complete.

Comment 16

[James Bonacci [:jbonacci]]

OK. For loop_server.yaml:
    fxaAudiences: 
        - "http://loop.services.mozilla.com"
        - "app://loop.services.mozilla.com"
    fxaVerifier: "https://verifier.accounts.firefox.com/v2"
    fxaTrustedIssuers: 
        - "api.accounts.firefox.com"
        - "msisdn.services.mozilla.com"


And for loop_server.stage.yaml
    fxaAudiences: 
        - "https://loop.stage.mozaws.net"
    fxaVerifier: "https://verifier.stage.mozaws.net/v2"
    fxaTrustedIssuers: 
        - "auth.stage.mozaws.net"

and further down:
    fxaAudiences: 
        - "https://loop.stage.mozaws.net"
        - "app://loop.stage.mozaws.net"
    fxaVerifier: "https://verifier.stage.mozaws.net/v2"
    fxaTrustedIssuers: 
        - "api-accounts.stage.mozaws.net"
        - "msisdn-dev.stage.mozaws.net"
        - "api.accounts.firefox.com"
        - "msisdn.stage.mozaws.net"
        - "msisdn.services.mozilla.com"


and, finally, for /data/loop-server/config/settings.json
    "fxaAudiences": [
        "app://loop.stage.mozaws.net",
        "https://loop.stage.mozaws.net"
    ],
    "fxaTrustedIssuers": [
        "api-accounts.stage.mozaws.net",
        "api.accounts.firefox.com",
        "msisdn-dev.stage.mozaws.net",
        "msisdn.services.mozilla.com",
        "msisdn.stage.mozaws.net"
    ],
    "fxaVerifier": "https://verifier.stage.mozaws.net/v2",



Stage looks good.
Let's get these config changes out to Production.

Comment 17

[Rémy Hubscher (:natim)]

We have the same ticket for Stage and Production. So I reopened. It has been closed for Stage. Lets do it for Production.

Comment 18

[James Bonacci [:jbonacci]]

Loop-Client Prod has been updated. This is our next bug to focus on.
I assume this will be Monday for EU, Tuesday for US peoples...

Comment 19

[James Bonacci [:jbonacci]]

It appears this is already in Prod. Having OPs check.

Comment 20

[James Bonacci [:jbonacci]]

Not in Prod, but in puppet configs - just needs to be pushed to Prod.
Sorry about that...

Comment 21

[Dean Wilson (:deanw)]

This has now been pushed to prod with code release 0.11.0

Comment 22

[James Bonacci [:jbonacci]]

I verified the changes to Prod via OPs...