965135 - Let tokenserver use new hosted verifier at https://verifier.accounts.firefox.com

Status: VERIFIED FIXED

(Cloud Services :: Server: Token, defect)

Description

[Ryan Kelly [:rfkelly]]

We need to support generation numbers and new-style assertion formats in tokenserver, and the existing persona.org verifier doesn't do that.  There's a hot new verifier at https://verifier.accounts.firefox.com that we should use instead.

This patch updates the tokenserver RemoteVerifier implementation to use it.  Because of API and format changes, it's easier to implement just what we need here rather than bringing the whole of PyBrowserID up to spec.  We should push this down into PyBrowserID at some point in the future.

Comment 1

[Ryan Kelly [:rfkelly]]

Attachment: tokenserver-new-verifier.diff

Comment 2

[James Bonacci [:jbonacci]]

/me wonders if we need a Dev and/or Stage ticket to match this one for Prod.

Comment 3

[Ryan Kelly [:rfkelly]]

They'll all get it by default as the new version of the code rolls out

Comment 4

[Toby Elliott [:telliott]]

Comment on attachment 8367123 [details] [diff] [review]
tokenserver-new-verifier.diff

Review of attachment 8367123 [details] [diff] [review]:
-----------------------------------------------------------------

The patch is fine. I'm a little worried about having external verification as part of this process along with such short-duration tokens, but we're obvioulsy not going to do local verification at this point.

Comment 5

[Ryan Kelly [:rfkelly]]

*nod*

Some additional discussion on potential paths forward in Bug 956222.

Comment 6

[Ryan Kelly [:rfkelly]]

https://github.com/mozilla-services/tokenserver/commit/6ff5aabd80273528b45d870172917ea927d2c129

Comment 7

[James Bonacci [:jbonacci]]

I think this has been pushed to Prod as well as Stage.