1380028 - [tracker] use auth0 to get Taskcluster credentials

Status: RESOLVED FIXED

(Taskcluster :: Services, enhancement)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

This entails implementing something like the proof-of-concept in bug 1354251.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Planned process to accomplish this:

  https://gist.github.com/djmitche/ac2ed4446f024a6cb978e8061487c5a7

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

My thinking for next steps are:

once https://github.com/taskcluster/taskcluster-tools/pull/307 lands
 - enable auth0, but leave Okta, in the tools site (with a tooltip indicating auth0 is being tested, ..)
 - test
 - disable Okta in the tools site

once that's complete and tools is no longer using the login UI
 - enable auth0 in the login site with suitable messaging about testing

Friday
 - disable Okta in the login site

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

auth0 is enabled on tools - just waiting for the CDN to realize that

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

>  - enable auth0, but leave Okta, in the tools site ✓
>  - test ✓
>  - enable auth0 in the login site with suitable messaging about testing ✓

I haven't disabled Okta anywhere yet -- I'll wait until tomorrow to see if there's any issue with session renewal, etc.

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

Okta's disabled everywhere now.  PR's are landing to remove support.

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/taskcluster-tools/pull/335

Comment 7

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/taskcluster-login/pull/64

These PRs are really just cleanup -- we are no longer using Okta.

Comment 8

[[github robot]]

Commits pushed to master at https://github.com/taskcluster/taskcluster-login

https://github.com/taskcluster/taskcluster-login/commit/bc970077cf0dda65322cec3a5ccdb6318d59f725
Bug 1380028 - remove Okta support

https://github.com/taskcluster/taskcluster-login/commit/3d8d3fb70b0fadea331d9286b06ebd1c9ccb9e31
Merge pull request #64 from djmitche/remove-okta

Bug 1380028 - remove Okta support

Comment 9

[[github robot]]

Commit pushed to master at https://github.com/taskcluster/taskcluster-tools

https://github.com/taskcluster/taskcluster-tools/commit/c32b7a17d0513ce5720d1c0d8192ccfcd5eccf76
Bug 1380028 - remove Okta support (and email)

Comment 10

[:gerard-majax]

Dustin, I have problems with the website since this got live. This morning I had to re-auth to Auth0 because Okta was not accepted, which I did, gave all permissions to TC. And now, intermittently but very often, the task inspector pages are popping with NetworkError, taking long time to load and effectively making me impossible to use TC when authenticated ; thus unable to retrigger tasks, etc.

NetworkError comes from a 503 HTTP error on the OPTIONS against https://login.taskcluster.net/v1/oidc-credentials/mozilla-auth0

Comment 11

[Dustin J. Mitchell [:dustin] (he/him)]

That appears to be Mozillians bustage -- I've filed bug 1404606 to track the TC impact, and disabled Mozillians logins for the moment, and bug 1404607 for the Mozillians bustage.

Comment 12

[:gerard-majax]

Thanks, I can confirm it looks much better now :)