1161873 - Switch pocket production credentials to trusted:false

Status: RESOLVED FIXED

(Cloud Services :: Operations: Miscellaneous, task, P1)

Description

[Ryan Kelly [:rfkelly]]

This is a follow-up to Bug 1157578 Comment 7, where we temporarily provisioned the pocket oauth credentials with trusted:true.  We need to coordinate on switching them over to the trusted:false status that we want to use for third-party reliers.

Actions, in order:

1) Confirm that the flow from https://github.com/mozilla/fxa-oauth-server/pull/248 is working as expected now that train-36 has been deployed.

2) Change the way scopes are requested by pocket, in line with the restricted scopes provided to third-party reliers.  We can deploy this on the pocket side without flipping the config on our side.

3) Switch the pocket dev credentials to trusted:false and test that it all works in a dev environment.

4) Switch the pocket prod credentials to trusted:false.

I'll own the first action, and will follow up here when we're ready to push forward with the changes.

Comment 1

[Justin Dolske [:Dolske]]

Not really sure of priority here, can you set the priority field so we can track it?

Comment 2

[Ryan Kelly [:rfkelly]]

P1 works for me, we really do need this done before release.

Comment 3

[Ryan Kelly [:rfkelly]]

OK, I've confirmed that the latest deployed code should work correctly with the restrictions we want to do here.  The next step is for Pocket to switch over from requesting:

  { "scope": "profile" }

To requesting the specific profile data that is needed:

  { "scope": "profile:uid profile:email profile:display_name"}

We've patched the profile endpoints to return partial profile data when presented with such tokens, so things should Just Work without further changes on the Pocket side of things.

All the changes should be live in both dev and prod environments.  Matt, can you please try this out and let us know when you've got it switched over on your side?

Comment 4

[Matt Koidin]

:rfkelly - I've made the change on both dev and staging to use: profile:uid+profile:email+profile:display_name

This is now live and confirmed working in both dev and prod on my end.

Comment 5

[Ryan Kelly [:rfkelly]]

I've changed the config on oauth-stable.dev.lcip.org to use `trusted: false`.  Once we confirm that this hasn't broken anything in dev, we'll give the OK to :ckolos to make the change in production.

Comment 6

[Ryan Kelly [:rfkelly]]

Matt, what URL sould I hit to test this out in dev?

Comment 7

[Ryan Kelly [:rfkelly]]

The answer was "firefox.dev.readitlater.com" and AFAICT it's working with the bit flipped.

Comment 8

[Ryan Kelly [:rfkelly]]

OK, over to :ckolos.  Please update the stage and production client records for Pocket to have `trusted: false`.  (The soon-to-be-legacy `whitelisted` property can be safely ignored).

We're pretty confident that this wont break anything, but at the slightest sign of trouble, it's safe to roll back to `trusted: true`.

Comment 9

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

this was completed in stage/prod and tested by mattk.

Comment 10

[Ryan Kelly [:rfkelly]]

> this was completed in stage/prod and tested by mattk.

It doesn't seem to have stuck in stage:

   curl https://oauth.stage.mozaws.net/v1/client/749818d3f2e7857f

     {
      "id":"749818d3f2e7857f",
      "name":"Pocket",
      "trusted":true,
      "image_uri":"",
      "redirect_uri":"https://staging.getpocket.com/ff_auth",
      "terms_uri":"",
      "privacy_uri":""
     }

Versus in prod:

   curl https://oauth.accounts.firefox.com/v1/client/749818d3f2e7857f

      {
        "id":"749818d3f2e7857f",
        "name":"Pocket",
        "trusted":false,
        "image_uri":"",
        "redirect_uri":
        "https://getpocket.com/ff_auth",
        "terms_uri":"","privacy_uri":""
      }

Comment 11

[Ryan Kelly [:rfkelly]]

Chris, please re-enable trusted:false in stage before deploying train-37 to production, so that we can test train-37 changes that do not apply to trusted reliers.

Comment 12

[John Morrison [:jrgm]]

:rfkelly - I'm looking into this now.

Comment 13

[John Morrison [:jrgm]]

I had rebuilt the oauth stack in production and switched to it. I reckon ckolos has a branch somewhere to change the config in puppet but it wasn't merged in. In the interim, I have set Pocket clients in stage to be `trusted = 0` (and `whitelisted = 0` fwiw).

Comment 14

[Ryan Kelly [:rfkelly]]

Seems to be working as expected now, thanks :jrgm!

Comment 15

[John Morrison [:jrgm]]

Just to document:

date; curl -s https://oauth.stage.mozaws.net/v1/client/749818d3f2e7857f | python -mjson.tool
Sat May 16 02:12:04 UTC 2015
{
    "id": "749818d3f2e7857f", 
    "image_uri": "", 
    "name": "Pocket", 
    "privacy_uri": "", 
    "redirect_uri": "https://staging.getpocket.com/ff_auth", 
    "terms_uri": "", 
    "trusted": false
}

Comment 16

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

:rfkelly :jrgm - this is exactly the case. I'm merging my branch this morning to avoid this going forward.