Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use JSON key type for auth #445

Merged
merged 3 commits into from
Dec 2, 2024
Merged

Use JSON key type for auth #445

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9d8e3db
Use JSON key type
tomrf1 Dec 2, 2024
7f7d899
s3 permission
tomrf1 Dec 2, 2024
34cf779
tidy up
tomrf1 Dec 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions app/com/gu/memsub/auth/common/KeystoreCredentials.scala
View file
Open in desktop

This file was deleted.

35 changes: 14 additions & 21 deletions app/com/gu/memsub/auth/common/MemSub.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,17 @@
package com.gu.memsub.auth.common

import com.amazonaws.auth.profile.ProfileCredentialsProvider
import com.amazonaws.auth.{AWSCredentialsProviderChain, InstanceProfileCredentialsProvider}
import com.amazonaws.services.s3.model.S3ObjectId
import com.amazonaws.services.s3.model.GetObjectRequest
import com.google.auth.oauth2.ServiceAccountCredentials
import com.gu.aws.AwsS3
import com.gu.googleauth.{AntiForgeryChecker, GoogleAuthConfig, GoogleGroupChecker}
import com.typesafe.config.Config
import play.api.http.HttpConfiguration

object MemSub {

object AWSCredentialsProvider {
val Dev = new ProfileCredentialsProvider("membership")
val Prod = InstanceProfileCredentialsProvider.getInstance
val Chain = new AWSCredentialsProviderChain(Dev, Prod)
}

object Google {
val GuardianAppsDomain = "guardian.co.uk"

object ServiceAccount {
val PrivateKeyLocation = new S3ObjectId("membership-private", "membership_directory_cert.p12")

lazy val PrivateKey = new S3PrivateKeyService(AWSCredentialsProvider.Chain).loadPrivateKey(PrivateKeyLocation)
}

def googleAuthConfigFor(config: Config, httpConfiguration: HttpConfiguration): GoogleAuthConfig = {
val c = config.getConfig("google.oauth")
GoogleAuthConfig(
Expand All @@ -37,12 +24,18 @@ object MemSub {
}

def googleGroupCheckerFor(config: Config): GoogleGroupChecker = {
val con = config.getConfig("google.directory.service_account")
new GoogleGroupChecker(con.getString("email"), ServiceAccountCredentials
.newBuilder()
.setClientEmail(con.getString("id"))
.setPrivateKey(ServiceAccount.PrivateKey)
.build())
val request = new GetObjectRequest("membership-private", "google-auth-service-account-certificate.json")
AwsS3.fetchObject(AwsS3.client, request).map { stream =>
val googleServiceAccountCredential = ServiceAccountCredentials.fromStream(stream)
stream.close()

val impersonatedUser = config.getString("google.oauth.impersonatedUser")

new GoogleGroupChecker(
impersonatedUser,
googleServiceAccountCredential
)
}.get // created on startup
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will throw if there's an issue with S3 or the config. The GoogleGroupChecker is required on startup so I think this is ok

}
}

Expand Down
27 changes: 0 additions & 27 deletions app/com/gu/memsub/auth/common/S3PrivateKeyService.scala
View file
Open in desktop

This file was deleted.

4 changes: 2 additions & 2 deletions cloudformation/memsub-promotions-cf.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,14 +51,14 @@ Mappings:
ReadableS3Resources:
- arn:aws:s3:::gu-reader-revenue-private/membership/promotions-tool/CODE/*
- arn:aws:s3:::gu-promotions-tool-dist/*
- arn:aws:s3:::membership-private/membership_directory_cert.p12
- arn:aws:s3:::membership-private/google-auth-service-account-certificate.json
- arn:aws:s3:::gu-zuora-catalog/PROD/* # i.e. generated by the PROD catalog service (this should be used when running in any stage)
PROD:
DNSName: memsub-promotions.gutools.co.uk
ReadableS3Resources:
- arn:aws:s3:::gu-reader-revenue-private/membership/promotions-tool/PROD/*
- arn:aws:s3:::gu-promotions-tool-dist/*
- arn:aws:s3:::membership-private/membership_directory_cert.p12
- arn:aws:s3:::membership-private/google-auth-service-account-certificate.json
- arn:aws:s3:::gu-zuora-catalog/PROD/*

Resources:
Expand Down