1533591 - adjust auth API to issue websocktunnel tokens with audience

Status: RESOLVED FIXED

(Taskcluster :: Services, enhancement)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

https://docs.taskcluster.net/docs/reference/platform/taskcluster-auth/references/api#websocktunnelToken
doesn't include anything about audiences, as added in bug 1517015.

Let's add wstAudience and wstClient params to that API method, and use "auth:websockproxy:<wstAudience>/<wstClient>" as the scope. So no more generation of a random tunnelId using slugid.

Vaibhav, is this something you'd be interested in working on? Time is a little critical -- ideally it'd be finished in a week or so. If that's too soon, I'm also happy to take care of this.

Comment 1

[Vaibhav Kaushik]

I will be happy to work on it & start working on it right away.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

I'm going to try to work on this this week; if not, please take it back next weekend :D

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/taskcluster/pull/437

Sorry Vaibhav! :)

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

deployed to production!

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

Attachment: Screenshot_2019-03-15 Logs Viewer - heroku-logging - Google Cloud Platform.png

https://console.cloud.google.com/logs/viewer?project=heroku-logging&minLogLevel=0&expandAll=false&timestamp=2019-03-15T20%3A16%3A44.042000000Z&customFacets&limitCustomFacetWidth=true&dateRangeStart=2019-03-15T19%3A19%3A43.101Z&dateRangeEnd=2019-03-15T20%3A19%3A43.101Z&interval=PT1H&resource=gce_instance%2Finstance_id%2Fheroku&scrollTimestamp=2019-03-15T20%3A15%3A53.978371000Z&advancedFilter=resource.type%3D%22gce_instance%22%0Aresource.labels.instance_id%3D%22heroku%22%0Aresource.labels.zone%3D%22heroku%22%0Aresource.labels.project_id%3D%22heroku-logging%22%0Atimestamp%3D%222019-03-15T20%3A15%3A53.964087000Z%22%0AinsertId%3D%2214iux1dfoidhmt%22

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

Ah, I had forgotten to rename the WEBHOOKTUNNEL_SECRET to WEBSOCKTUNNEL_SECRET in Heroku.

Comment 7

[Vaibhav Kaushik]

It was a big task indeed, I would have taken more a week for sure.

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Oh, I still need to deploy this with terraform.

Comment 9

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/taskcluster/pull/461
https://github.com/taskcluster/taskcluster-mozilla-terraform/pull/46