1369384 - improve balrog authentication story

Status: RESOLVED FIXED

(Release Engineering Graveyard :: Applications: Balrog (backend), enhancement, P3)

Description

[[e-mail] (:bhearsum)]

Balrog currently uses HTTP Basic authorization, which is handled by nginx (which uses LDAP as a backend). This is not ideal for humans (because we can't enforce MFA) nor machines (because we don't like using username+password auth for machines). We should improve this by using auth0 for human authentication, and some sort of token based thing (oauth2?) for machine authentication.

Comment 1

[[e-mail] (:bhearsum)]

https://mana.mozilla.org/wiki/display/SVCOPS/auth0proxy might be helpful for this.

Comment 2

[[e-mail] (:bhearsum)]

Julien, catlee thought you might have some thoughts on this.

Comment 3

[Julien Vehent]

I think the auth0proxy story would solve this, so we should piggyback on it. CC-ing miles who's working on that project.

Kang might have ideas for the machine token story using auth0, cc-ing him as well.

Comment 4

[Miles Crabill [:miles]]

The auth0proxy is still WIP and is basically a "when I have time" level of priority. There is still some work to be done on it and I'm fairly tied up, so I can't give an absolute date.

Having auth0 in front of your app is a prerequisite to using the auth0proxy, and we already have admin panel applications that have auth0 in front of them using lua-resty-openidc and nginx. CC'ing relud who would be able to easily implement that auth in front of balrog admin.

Comment 5

[[e-mail] (:bhearsum)]

I'm most likely going to be looking at this in the next couple of months.

Comment 6

[[e-mail] (:bhearsum)]

This has been deprioritized, unassigned for now.

Comment 7

[[e-mail] (:bhearsum)]

The current authentication situation was raised in a recent AUS security audit as something to be replaced. In particular, they noted that HTTP auth offers insufficient protection against brute force. We should really switch to Auth0.

I think the authorization story is a different matter, with no obvious solution. Even if we move it out of Balrog itself, that should be a separate project. I'm rescoping this bug to look specifically at authentication - which is the more pressing piece.

Comment 8

[Nick Thomas [:nthomas] (UTC+12)]

miles, how is auth0proxy looking now ?

Comment 9

[Miles Crabill [:miles]]

We stopped working on the auth0proxy because downstream apps would still need to have openresty with some openidc logic in front of them to verify sessions, i.e. it did not offer much.

We use the lua-resty-openidc openresty modules to handle auth0 in a number of other cases, and I think that would work here. I'm no longer on ops for balrog - that baton has been passed to oremj.

Comment 10

[[e-mail] (:bhearsum)]

We moved to auth0 last week!