1586029 - Please provision stage/production OAuth credentials for "Firefox Lite" client

Status: RESOLVED FIXED

(Cloud Services :: Server: Firefox Accounts, task)

Description

[Wil Clouser [:clouserw]]

Please provision stage/production Oauth credentials:

{
 "id": "bd8e8b17e9359f53",
 "name": "Firefox Lite",
 "hashedSecret": "0000000000000000000000000000000000000000000000000000000000000000",
 "redirectUri": "",
 "imageUri": "",
 "canGrant": false,
 "termsUri": "",
 "privacyUri": "",
 "publicClient": true,
 "trusted": true
}

We'll still need a short name for Amplitude. Maybe "fx-lite"?

Comment 1

[Wil Clouser [:clouserw]]

Wesly: We need to know the redirect URI. Where should we send people after they authenticate?

Comment 2

[John Morrison [:jrgm]]

Any allowedScopes required? (Just checking).

Comment 3

[John Morrison [:jrgm]]

Did PR for cloudops deployment repo - https://github.com/mozilla-services/cloudops-deployment/pull/3447

Comment 4

[Shane Tomlinson [:stomlinson]]

(In reply to John Morrison [:jrgm] from comment #2)

Any allowedScopes required? (Just checking).

In an email thread, Wesley only requested the "profile" scope.

Comment 5

[Wesly Huang (EPM)]

thanks Wil, John, and Shane.

1. Wil, just to be sure, I believe the short name for amplitude is not a qusstion to our team, right?
2. need the redirect uri
3. need to confirm the allowedScope (what I got is only profile)

@nevin, would you help on 2) and 3) above? thanks.

Comment 6

[Shane Tomlinson [:stomlinson]]

Opened https://github.com/mozilla/fxa/issues/2749 to get an icon for FxA's Apps & Devices panel.

Comment 7

[John Morrison [:jrgm]]

For the amplitude short name, Shane picked firefox-lite in https://github.com/mozilla-services/cloudops-deployment/pull/3449/files (which supersedes my https://github.com/mozilla-services/cloudops-deployment/pull/3447)

Comment 8

[Wil Clouser [:clouserw]]

Wil, just to be sure, I believe the short name for amplitude is not a qusstion to our team, right?

correct

Comment 9

[Nevin Chen(Not active on Bugzilla)]

(In reply to Wesly Huang (EPM) from comment #5)

thanks Wil, John, and Shane.

1. Wil, just to be sure, I believe the short name for amplitude is not a qusstion to our team, right?
2. need the redirect uri

the redirect production URL is not ready yet. I assume we can change it by ourselves in the future?

3. need to confirm the allowedScope (what I got is only profile)

Yes

@nevin, would you help on 2) and 3) above? thanks.

Comment 10

[Wil Clouser [:clouserw]]

You won't be able to change it by yourselves. It's part of the configuration stored in FxA.

Comment 11

[John Morrison [:jrgm]]

Added entry in stage per https://bugzilla.mozilla.org/show_bug.cgi?id=1586029#c0 with also allowedScopes = profile', andredirectUri` = "" (empty).

If that's correct for production, I'll add it there tomorrow morning.

Comment 12

[Nevin Chen(Not active on Bugzilla)]

The redirect API endpoint

Production:
Firefox Lite
https://zerda-dcf76.appspot.com/api/v1/login

Staging
Firefox Lite Preview
https://rocketnightly.appspot.com/api/v1/login

Thank you!

Comment 13

[John Morrison [:jrgm]]

Stage is update for redirectUri and name:

$ curl -s https://oauth.stage.mozaws.net/v1/client/bd8e8b17e9359f53 | python -mjson.tool
{
"id": "bd8e8b17e9359f53",
"name": "Firefox Lite Preview",
"trusted": true,
"image_uri": "",
"redirect_uri": "https://rocketnightly.appspot.com/api/v1/login"
}

Prod client entry added perl comment #0 and updates in comment #12

$ curl -s https://oauth.accounts.firefox.com/v1/client/bd8e8b17e9359f53 | python -mjson.tool
{
"id": "bd8e8b17e9359f53",
"name": "Firefox Lite",
"trusted": true,
"image_uri": "",
"redirect_uri": "https://zerda-dcf76.appspot.com/api/v1/login"
}

Comment 14

[Nevin Chen(Not active on Bugzilla)]

Thanks!
May I know how can I get the secret so I can set up my server?
Thank you!

Comment 15

[Shane Tomlinson [:stomlinson]]

(In reply to Nevin Chen(Not active on Bugzilla) from comment #14)

Thanks!
May I know how can I get the secret so I can set up my server?
Thank you!

Nevin, Is it going to be the browser or a backend that trades the authorization code for the access token? If the browser, then no secrets are needed, if it's the backend, then we are going to have to update our config.

Comment 16

[Nevin Chen(Not active on Bugzilla)]

Hi Shane
It's the backend that the Firefox Lite team builds.
Thank you!

Comment 17

[Shane Tomlinson [:stomlinson]]

(In reply to Nevin Chen(Not active on Bugzilla) from comment #16)

Hi Shane
It's the backend that the Firefox Lite team builds.
Thank you!

Thanks Nevin, are you going to be the person receiving the OAuth credentials?

:jrgm or :jbuck, could you please generate client secrets in stage & prod for Firefox Lite and change the database configs to have:

publicClient: false
hashedSecret: <hash of secret>

Comment 18

[Nevin Chen(Not active on Bugzilla)]

(In reply to Shane Tomlinson [:stomlinson] from comment #17)

Thanks Nevin, are you going to be the person receiving the OAuth credentials?

Yes. I'll be the person receiving the OAuth credentials.
You can send it via my Mozilla Email.
Thank you!

Comment 19

[John Morrison [:jrgm]]

Hi Nevin. Could you put a gpg key in Mozilla phonebook?

Comment 20

[Ryan Kelly [:rfkelly]]

It's the backend that the Firefox Lite team builds.

Sorry to chime in late here, but if the login tokens are being held by a backend service component, I'm not sure it makes sense to call this client "Firefox Lite". Will it appear to the user as though they're signing in to the Firefox Lite browser itself, or will it be more akin to signing in to a service on the web?

I'm wondering if this client should be called something like "Firefox Lite Missions", because if I understand the architecture correctly, the FxA tokens end up being held by a server that manages the missions database rather than held by Firefox Lite itself.

Comment 21

[Nevin Chen(Not active on Bugzilla)]

Hi Joe
Can you help answer comment 20?
Thank you!