1455666 - Need to replace the authorized_groups line with: authorized_groups: ['everyone'] - Airmozilla

Status: RESOLVED FIXED

(Infrastructure & Operations :: Infrastructure: LDAP, task)

Description

[Andy Kochendorfer]

Jabba,

Henrik asked that I file the following bug:


Megan was testing New AirMo login flows and found out that login for non-NDA'd Mozillians is not working.

This is correct behavior according to the current configuration - but I guess the configuration is wrong:

https://github.com/mozilla-iam/sso-dashboard-configuration/blob/f49b7a7e2b5a408641fc48e47f0f1e47f58c7bef/apps.yml#L39


    - application:
    name: "Air Mozilla"
    client_id: "7euXeq96glWUS85bwDRCCs10xKGY93t0"
    op: auth0
    url: "https://onlinexperiences.com/scripts/Server.nxp?LASCmd=L:0&AI=1&InitialDisplay=1&ClientBrowser=0&ShowKey=44908"
    logo: "airmo.png"
    authorized_users: []
    authorized_groups: ['mozilliansorg_nda', 'team_moco', 'team_mofo', 'team_mozillaonline']
    display: true
    vanity_url: ['/airmo']



In order to be publicly accessible using passwordless email authentication, we need to replace the authorized_groups line with:

    authorized_groups: ['everyone']


New AirMo will then use OIDC claims to make sure to show Staff&NDA assets only to people coming in with the correct groups (e.g. mozilliansorg_nda, team_moco, team_mofo').

Thanks!

Comment 1

[Justin Dow [:jabba]]

I've created https://github.com/mozilla-iam/sso-dashboard-configuration/pull/142 . Once reviewed and merged, this should work.

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

Hi,

passwordless email authentication does not have any group assigned, and cannot have groups assigned except for 'everyone'.
This means that there is no 'mozilliansorg_nda" members that have a passwordless account.
This is also why, if the RP access is limited by authorized_groups, passwordless cannot work.

Passwordless only works if authorized_groups includes the 'everyone' group.

There is no correct way to check if a passwordless account is member of any group, are they cannot be part of any group except 'everyone' 

I'm acking https://github.com/mozilla-iam/sso-dashboard-configuration/pull/142 ; though wanted to make sure this part was clear, just in case

Comment 3

[Justin Dow [:jabba]]

I merged the PR.

Comment 4

[Henrik Mitsch [:hmitsch]]

kang, for the record: Yes, what you said in Comment 2 is clear to me. Thanks!