1685143 - automate revoking access

Status: ASSIGNED

(Socorro :: Webapp, task, P1)

Description

[Will Kahn-Greene [:willkg] ET needinfo? me]

A while back, we added an auditgroups job that ran once a week and audited the protected data group removing users who hadn't logged in for a while or didn't meet certain criteria.

We want to enhance that by revoking access and expiring API tokens for users with protected data access who are no longer with Mozilla.

Jason suggests we can use the PersonAPI to do this:

https://github.com/mozilla-iam/cis/blob/master/docs/PersonAPI.md

This bug covers looking into that and if it's viable, doing it.

Comment 1

[Will Kahn-Greene [:willkg] ET needinfo? me]

We might even be able to skip the whole auto-verification thing and implement a webhook that CIS can hit that triggers revoking:

https://github.com/mozilla-iam/cis/blob/master/docs/Hooks.md

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

Once we figure this out for Socorro, we should open up a bug and do the same thing for Tecken.

Comment 3

[Will Kahn-Greene [:willkg] ET needinfo? me]

Grabbing this to do this quarter.

Comment 4

[Will Kahn-Greene [:willkg] ET needinfo? me]

Bumping bugs off my queue because I'm not going to get to them any time soon.

Comment 5

[Haseeb Afzal]

See also: bug-1895320 and bug-1480858 as they show extra context about the problem.

Comment 6

[Bianca Danforth [:bdanforth]]

Once we have a finalized plan for the work, we should make sure bug 1480858 and bug 1895320 are updated accordingly (e.g. marked as duplicates or otherwise), and we should ensure that the JIRA analog is associated with an epic for tracking purposed.

Comment 7

[Haseeb Afzal]

Attachment: [mozilla-services/socorro] bug-1685143: automate revoke access (#7182Edit title)

Comment 8

[Haseeb Afzal]

Attachment: [mozilla/webservices-infra] chore(socorro): add auth0 users api endpoint to config (#11011)

Comment 9

[Haseeb Afzal]

Attachment: [mozilla-services/socorro] bug-1685143: Changed Auth0 Audience URL (#7202Edit title)

Comment 10

[Haseeb Afzal]

I have verified that the new AUTH0_MANAGEMENT_API_ENDPOINT env variable is in the Socorro environment.