1064505 - Create OAuth credentials for Desktop/Fennec/FxOS/FxA in stage and prod

Status: RESOLVED FIXED

(Cloud Services :: Operations: Miscellaneous, task)

Description

[Sean McArthur [:seanmonstar]]

The names will be different in each environment, but we want to keep the id's the same, so I'm providing the ids used in dev.

 {
 "id": "5882386c6d801776",
 "name": "Firefox Dev",
 "hashedSecret": "0000000000000000000000000000000000000000000000000000000000000000",
 "imageUri": "",
 "redirectUri": "",
 "whitelisted": true,
 "canGrant": true
 },
 {
 "id": "3332a18d142636cb",
 "name": "Fennec Dev",
 "hashedSecret": "0000000000000000000000000000000000000000000000000000000000000000",
 "imageUri": "",
 "redirectUri": "",
 "whitelisted": true,
 "canGrant": true
 },
 {
 "id": "d0eea24a1d613eeb",
 "name": "Firefox OS Dev",
 "hashedSecret": "0000000000000000000000000000000000000000000000000000000000000000",
 "imageUri": "",
 "redirectUri": "",
 "whitelisted": true,
 "canGrant": true
 },
 {
 "id": "ea3ca969f8c6bb0d",
 "name": "Firefox Accounts Dev",
 "hashedSecret": "0000000000000000000000000000000000000000000000000000000000000000",
 "imageUri": "",
 "redirectUri": "",
 "whitelisted": true,
 "canGrant": true
 }

Comment 1

[Chris Karlof [:ckarlof]]

We should probably drop the "Dev" from each of the names. I'm not sure what that implies. These clients represent our user agents.

Comment 2

[Chris Karlof [:ckarlof]]

Sean, since these clients don't use secrets, ideally they wouldn't be configured with one. Can we just omit the hashedSecret?

Comment 3

[Sean McArthur [:seanmonstar]]

The first sentence mentions how the names may differ by environment; I imagined -stage being the suffix in stage, but whichever.

So, the clients will never use the secrets, since they will be doing implicit grants. Perhaps they should be unique hashes, and the secrets are thrown away, since they aren't needed.

Comment 4

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

:seanmonstar I thought that accounts must exist in both the stage and prod db's.

My understanding is (for example), the stage DB would require a Firefox OS (stage/dev/whatever) account *and* so would the Prod DB. In addition, the Prod DB requires a set of credentials for 'actual real prod non-testing' accounts. Is that not the case with this set of creds?

Comment 5

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

This was completed for train-22 deployment