820643 - Consider switching from MACAuth to "Hawk Auth" protocol

Status: VERIFIED FIXED

(Cloud Services Graveyard :: Server: Sync, enhancement)

Description

[Ryan Kelly [:rfkelly]]

(Just flagging this for consideration, no changes and no work are being proposed at this time)

Due to the untimely death of OAuth2.0, the MAC Access Auth protocol that we're currently using in tokenserver/sync2.0 seems destined to rot in limbo, never quite making it out of draft status and not seeing widespread support in other products.

The new hotness is apparently "Hawk Auth", which is Eran Hammer's standalone revisiting of the protocol.  It seems broadly similar to MAC Access Auth, but with enough small changes that we can't just slot it in with existing code:

  https://github.com/hueniverse/hawk

The identity team seem to be standardizing on Hawk Auth for some upcoming products e.g. gombot.  As much as I don't want to change the code we have, I think there's some value in using a single, consistent protocol across all Mozilla properties.

I am *not* suggesting we rush out to change over to it at this time, especially not after the previous switchover from 2L-OAuth to MACAuth.  Protocol details may still be in flux and there's no RFC or other formal spec.  But it's worth thinking about and keeping an eye on.  Hawk Auth may become the "one obvious way" to do hmac-based authentication of http requests.

Hypothetically, the work involved in such a transition would be pretty minimal. Basically just refactoring the macauthlib and pyramid_macauth libraries to use the new protocol - tokenserver could stay the same, sync codebase would be nonethewiser.  AFAICT client changes should be similarly minimal.

Comment 1

[Alexis Metaireau (:alexis)]

I guess the question is more a product-related one: do we want to support the token-server, since we're not using it anywhere?

I would be happy to update the code to use HAWK rather than MAC Auth if we decide to go further this way.

Comment 2

[Ryan Kelly [:rfkelly]]

No code changes necessary in the tokenserver, since Hawk and MAC can both be done from the same set of credentials.  Any changes would be downstream in the sync storage servers which consume the signed requests.

Comment 3

[James Bonacci [:jbonacci]]

Relevant/related ticket: 
https://bugzilla.mozilla.org/show_bug.cgi?id=911384

Comment 4

[Ryan Kelly [:rfkelly]]

We're doing this; the necessary docs have been updated and implementations will be tracked separately.

Comment 5

[James Bonacci [:jbonacci]]

Yep.