963209 - FxA needs to use production verifier

Status: RESOLVED FIXED

(Cloud Services :: Server: Firefox Accounts, defect)

Description

[Edwin Wong [:edwong]]

Currently FxA uses persona's verifier. It should use the new one that Lloyd stood up. 

Current thinking is that the Persona and FxA verifier have interoperable formats and that we don't need to sync up the change between clients and server.  For example: Android can use Persona verifier and Auth-server can use FxA verifier for a short period of time.

Comment 1

[James Bonacci [:jbonacci]]

Actually we should probably add here the links to the GitHub issues that are specific to Stage and Prod Verifier config and deploy.

Comment 2

[Richard Newman [:rnewman]]

This doesn't seem actionable yet as part of Bug 799726. Could you file an intermediate bug detailing what the required action is for Android?

Comment 3

[Ryan Kelly [:rfkelly]]

> For example: Android can use Persona verifier and Auth-server can use FxA verifier for a short period of time.

Sorry, but I can't parse this.  The three fxa+sync-related actors in this system all have a different part to play in the verification dance, and only one "uses a verifier".

  * the fxa-auth-server needs to generate certificates in a certain format, presumably the new format if we're switching over to the new verifier
  * the client code in firefox needs to generate assertions based on those certificates, presumably matching the format used by fxa-auth-server
  * the tokenserver needs to submit those assertions to a verifier, presumably the new one if everyone else is using the new assertion format

ISTM that the possibility of updating any of these components independently depends wholly on the level of backwards-compatibility in the the new verifier wrt old-format assertions.   If it accepts assertions where the certificate is new-format but the claim is old-format for example, then we can fiddle this those two independently on client and server.

Comment 4

[Mark Hammond [:markh] [:mhammond]]

This doesn't block the work for desktop fxa

Comment 5

[Chris Karlof [:ckarlof]]

"Using" the production verifier means the token server using it, not us.

Comment 6

[Ryan Kelly [:rfkelly]]

This all got sorted out in the end