1057125 - Create OAuth credentials for Loop in stage and prod

Status: VERIFIED FIXED

(Cloud Services :: Operations: Miscellaneous, task)

Description

[Sean McArthur [:seanmonstar]]

client_id: "ae6d64798e60265b"
client_secret: <generate 32-byte hex>
image_uri: ""
whitelisted: true
canGrant: false
redirect_uri: "urn:ietf:wg:oauth:2.0:fx:webchannel"

Comment 1

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

are you gen'ing the secret or do you need me to?

Comment 2

[Edwin Wong [:edwong]]

I think these are all the steps:
* deploy STAGE Oauth with generated creds
* deploy PROD Oauth with generated prod creds
* deploy STAGE Loop server with generated stage creds
* deploy PROD Loop server with generated prod creds

Ideally this happens by 8/29 prior to when OAuth Loop goes live in nightly on 9/2

Comment 3

[Sean McArthur [:seanmonstar]]

@ckolos: I assumed you would, so as not to share the secrets elsewhere. If I do (I don't mind), I'll need to mark this bug private.

Comment 4

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

looks like there's a new parameter to the account config: canGrant  . Is that supported in the current prod version of the app?

Comment 5

[John Morrison [:jrgm]]

> looks like there's a new parameter to the account config: canGrant  . Is that supported in the current prod version of the app?

Yes, that is supported in the 0.19.0 or 0.20.0 versions of oauth, and the column is in the stage database. 
However, is there an open ticket to do that alter table in production?

Comment 6

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

:jrgm, there is not.

Comment 7

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

also, I would prefer that we roll the Loop creds with the OAuth prod deployment that includes the DB alter. Since stage is testing against the Prod DB, it makes more sense to me to only add the creds once with all fields included rather than add them when missing the canGrant field.

Comment 8

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

also, :ckarlof, are the loop prod cred/data the same minus the pw or are there imageurl/redirecturi differences?

Comment 9

[John Morrison [:jrgm]]

:ckolos - hey, do you also have new creds in hiera for stage?

Comment 10

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

:jrgm I'm confused... I thought stage was using the prod OAuth db instance

Comment 11

[John Morrison [:jrgm]]

:ckolos stage, as in oauth.stage.mozaws.net, is definitely not talking to a prod database (the hostname says stage, the data all has names like 'Identity STAGE', in credentials in a config file named 'stage.json').

Comment 12

[Chris Karlof [:ckarlof]]

:ckolos, client_secret is the only thing that needs to change between the different deployments.

Comment 13

[Chris Karlof [:ckarlof]]

:ckolos, regarding your prod/stage question,

You're correct that staging deployments of our *reliers* (e.g, Loop, FMD) will use the prod deployment/DB of OAuth, but our own staging deployment of OAuth is isolated from prod and has its own test reliers.

Comment 14

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

creds for loop-stage-really-in-stage and loop-stage-really-in-prod have been added to the manifests and are awaiting the deployment this week for oauth.

Comment 15

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

oauth train-20 has been deployed and these new creds are now live.

Comment 16

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

:deanw will take care getting the secrets to the necessary folks

Comment 17

[Chris Karlof [:ckarlof]]

Chris,

We're having a bug in Loop prod where during the FxA login is showing the name "Loop Stage". The client_id is "ae6d64798e60265b". Either the Loop OAuth config for "ae6d64798e60265b" has the wrong name configured (it currently says "Loop Stage").

The final product name is "Firefox Hello" so the *production credentials* for "Loop" needs to be updated to that. However, it's not clear if production OAuth creds for Loop were ever created:

> creds for loop-stage-really-in-stage and loop-stage-really-in-prod have been added to the manifests and are awaiting the deployment this week for oauth.

In this language, what I'm asking for is "loop-prod-really-in-prod" credentials, with the name configured as "Firefox Hello". If those already exist, the Loop production server is not configured to use them.

Comment 18

[Chris Karlof [:ckarlof]]

> We're having a bug in Loop prod where during the FxA login is showing the name "Loop Stage". The client_id is "ae6d64798e60265b". Either the Loop OAuth config for "ae6d64798e60265b" has the wrong name configured (it currently says "Loop Stage").

should read:

We're having a bug in Loop prod where during the FxA login is showing the name "Loop Stage". The client_id is "ae6d64798e60265b".

Comment 19

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

:ckarlof as we discussed just now, no, the final-production creds had not yet been created. I have created them for the "Firefox Hello" product and updated the server/DB. as before, :dwilson can get the "Firefox Hello" creds to the correct people.

Comment 20

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

:bobm is taking care of this for dwilson.

Comment 21

[Bob Micheletto [:bobm]]

(In reply to Chris Kolosiwsky [:ckolos] from comment #20)
> :bobm is taking care of this for dwilson.

An updated config has been pushed to production.

Comment 22

[James Bonacci [:jbonacci]]

Waiting to verify configs next before marking this bug Verified.

Comment 23

[James Bonacci [:jbonacci]]

Verified the new credentials withing configs and yamls.
Thanks to OPs for helping with this.