generated from CDCgov/template
-
Notifications
You must be signed in to change notification settings - Fork 40
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #16768 from CDCgov/deployment/2024-12-10
Deployment of 2024-12-10
- Loading branch information
Showing
67 changed files
with
2,493 additions
and
883 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| # Checksum Validate Action | ||
|
|
||
| [](https://github.com/JosiahSiegel/checksum-validate-action/actions/workflows/test_action.yml) | ||
|
|
||
| ## Synopsis | ||
|
|
||
| 1. Generate a checksum from either a string or shell command (use command substitution: `$()`). | ||
| 2. Validate if checksum is identical to input (even across multiple jobs), using a `key` to link the validation attempt with the correct generated checksum. | ||
| * Validation is possible across jobs since the checksum is uploaded as a workflow artifact | ||
|
|
||
| ## Usage | ||
|
|
||
| ```yml | ||
| jobs: | ||
| generate-checksums: | ||
| name: Generate checksum | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/[email protected] | ||
|
|
||
| - name: Generate checksum of string | ||
| uses: ./.github/actions/checksum-validate@ebdf8c12c00912d18de93c483b935d51582f9236 | ||
| with: | ||
| key: test string | ||
| input: hello world | ||
|
|
||
| - name: Generate checksum of command output | ||
| uses: ./.github/actions/checksum-validate@ebdf8c12c00912d18de93c483b935d51582f9236 | ||
| with: | ||
| key: test command | ||
| input: $(cat action.yml) | ||
|
|
||
| validate-checksums: | ||
| name: Validate checksum | ||
| needs: | ||
| - generate-checksums | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/[email protected] | ||
|
|
||
| - name: Validate checksum of valid string | ||
| id: valid-string | ||
| uses: ./.github/actions/checksum-validate@ebdf8c12c00912d18de93c483b935d51582f9236 | ||
| with: | ||
| key: test string | ||
| validate: true | ||
| fail-invalid: true | ||
| input: hello world | ||
|
|
||
| - name: Validate checksum of valid command output | ||
| id: valid-command | ||
| uses: ./.github/actions/checksum-validate@ebdf8c12c00912d18de93c483b935d51582f9236 | ||
| with: | ||
| key: test command | ||
| validate: true | ||
| fail-invalid: true | ||
| input: $(cat action.yml) | ||
|
|
||
| - name: Get outputs | ||
| run: | | ||
| echo ${{ steps.valid-string.outputs.valid }} | ||
| echo ${{ steps.valid-command.outputs.valid }} | ||
| ``` | ||
| ## Workflow summary | ||
| ### ✅ test string checksum valid ✅ | ||
| ### ❌ test string checksum INVALID ❌ | ||
| ## Inputs | ||
| ```yml | ||
| inputs: | ||
| validate: | ||
| description: Check if checksums match | ||
| default: false | ||
| key: | ||
| description: String to keep unique checksums separate | ||
| required: true | ||
| fail-invalid: | ||
| description: Fail step if invalid checksum | ||
| default: false | ||
| input: | ||
| description: String or command for checksum | ||
| required: true | ||
| ``` | ||
| ## Outputs | ||
| ```yml | ||
| outputs: | ||
| valid: | ||
| description: True if checksums match | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| # action.yml | ||
| name: Checksum Validate Action | ||
| description: Generate and validate checksums | ||
| branding: | ||
| icon: 'lock' | ||
| color: 'orange' | ||
| inputs: | ||
| validate: | ||
| description: Check if checksums match | ||
| default: false | ||
| key: | ||
| description: String to keep unique checksums separate | ||
| required: true | ||
| fail-invalid: | ||
| description: Fail step if invalid checksum | ||
| default: false | ||
| input: | ||
| description: String or command for checksum | ||
| required: true | ||
| outputs: | ||
| valid: | ||
| description: True if checksums match | ||
| value: ${{ steps.validate_checksum.outputs.valid }} | ||
|
|
||
| runs: | ||
| using: "composite" | ||
| steps: | ||
|
|
||
| # CHECKSUM START | ||
| - name: Generate SHA | ||
| uses: nick-fields/[email protected] | ||
| with: | ||
| max_attempts: 5 | ||
| retry_on: any | ||
| timeout_seconds: 10 | ||
| retry_wait_seconds: 15 | ||
| command: | | ||
| function fail { | ||
| printf '%s\n' "$1" >&2 | ||
| exit "${2-1}" | ||
| } | ||
| input_cmd="${{ inputs.input }}" || fail | ||
| sha="$(echo "$input_cmd" | sha256sum)" | ||
| echo "sha=$sha" >> $GITHUB_ENV | ||
| echo "success=true" >> $GITHUB_ENV | ||
| - name: Get input SHA | ||
| if: env.success | ||
| id: input_sha | ||
| shell: bash | ||
| run: echo "sha=${{ env.sha }}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Get input SHA | ||
| if: env.success != 'true' | ||
| shell: bash | ||
| run: | | ||
| echo "failed to generate sha" | ||
| exit 1 | ||
| # CHECKSUM END | ||
|
|
||
| # UPLOAD FILE START | ||
| - name: Create checksum file | ||
| if: inputs.validate != 'true' | ||
| shell: bash | ||
| run: | | ||
| echo "${{ steps.input_sha.outputs.sha }}" > "${{ github.sha }}-${{ inputs.key }}.txt" | ||
| - name: Upload checksum file | ||
| if: inputs.validate != 'true' | ||
| uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 | ||
| with: | ||
| name: "${{ github.sha }}-${{ inputs.key }}.txt" | ||
| path: "${{ github.sha }}-${{ inputs.key }}.txt" | ||
| retention-days: 5 | ||
| # UPLOAD FILE END | ||
|
|
||
| # VALIDATE FILE START | ||
| - name: Download checksum file | ||
| if: inputs.validate == 'true' | ||
| uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe | ||
| with: | ||
| name: "${{ github.sha }}-${{ inputs.key }}.txt" | ||
|
|
||
| - name: Validate pre and post checksums | ||
| if: inputs.validate == 'true' | ||
| id: validate_checksum | ||
| shell: bash | ||
| run: | | ||
| echo "${{ steps.input_sha.outputs.sha }}" > "${{ github.sha }}-${{ inputs.key }}-2.txt" | ||
| DIFF=$(diff -q "${{ github.sha }}-${{ inputs.key }}-2.txt" "${{ github.sha }}-${{ inputs.key }}.txt") || true | ||
| codevalid=true | ||
| if [ "$DIFF" != "" ] | ||
| then | ||
| codevalid=false | ||
| fi | ||
| echo "valid=$codevalid" >> $GITHUB_OUTPUT | ||
| - name: Create summary | ||
| if: inputs.validate == 'true' | ||
| run: | | ||
| # Use ternary operator to assign emoji based on validity | ||
| emoji=${{ steps.validate_checksum.outputs.valid == 'true' && '✅' || '❌' }} | ||
| valid=${{ steps.validate_checksum.outputs.valid == 'true' && 'valid' || 'INVALID' }} | ||
| echo "### $emoji ${{ inputs.key }} checksum $valid $emoji" >> $GITHUB_STEP_SUMMARY | ||
| shell: bash | ||
| # VALIDATE FILE END | ||
|
|
||
| - name: Fail if invalid checksum | ||
| if: inputs.validate == 'true' && steps.validate_checksum.outputs.valid == 'false' && inputs.fail-invalid == 'true' | ||
| run: exit 1 | ||
| shell: bash |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| # Running the Auth Microservice | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| A few secrets are required to run the Auth which are not committed to source. These values are | ||
| configured in Okta. | ||
|
|
||
| | Environment variable | Value | | ||
| |----------------------|---------------------------------| | ||
| | OKTA_ADMIN_CLIENT_API_ENCODED_PRIVATE_KEY | Base 64 encoded private key pem | | ||
| | SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT_SECRET | Base 64 encoded secret | | ||
|
|
||
| ## How to run application locally | ||
|
|
||
| ```bash | ||
| # from project root | ||
| # start ReportStream and all dependent docker containers | ||
| ./gradlew quickRun | ||
| # start submissions service | ||
| ./ gradlew submissions:bootRun | ||
| # start auth service | ||
| ./gradlew auth:bootRun | ||
| ``` | ||
|
|
||
| ## Setup a Sender | ||
|
|
||
| - Sign in to Admin Okta | ||
| - Applications -> Application tab | ||
| - Click "Create App Integration" | ||
| - Select "API Services" and click next | ||
| - Name your sender | ||
| - Copy your client ID and client secret or private key locally to be used while calling the /token endpoint | ||
| - Add the user to the appropriate sender group | ||
| - You can find this option on the small gear next to your newly created application | ||
| - Ensure the group has the prefix DHSender_ | ||
|
|
||
| ## Submitting reports locally | ||
|
|
||
| - Retrieve an access token directly from Okta and ensure the JWT contains the "sender" scope | ||
| - Make a well-formed request to https://reportstream.oktapreview.com/oauth2/default/v1/token to retrieve your access token | ||
| - [See Okta documentation on that endpoint here](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#get-an-access-token) | ||
| - Submit your report to http://localhost:9000/api/v1/reports | ||
| - Note the it's port 9000 which is auth rather than directly to 8880 which is submissions | ||
| - See endpoint definition in [SubmissionController](../../submissions/src/main/kotlin/gov/cdc/prime/reportstream/submissions/controllers/SubmissionController.kt) | ||
| - Add the access token you retrieved from Okta as a `Bearer` token in the `Authorization` header | ||
| - Inspect the logs if you received a 401 or a 403. This indicates there is an issue with your access token. | ||
|
|
||
| ## Notes on secrets | ||
|
|
||
| The Okta-Groups JWT signing key pair has a local dev value already set up appropriately in auth and | ||
| downstream in submissions. New values _must_ be generated for deployed environments. You can look | ||
| at [KeyGenerationUtils](../src/test/kotlin/gov/cdc/prime/reportstream/auth/util/KeyGenerationUtils.kt) | ||
| for scripts to run to generate new keys. | ||
|
|
||
| By Default, we are connecting to the Staging Okta. We cannot post connection secrets directly in this document so | ||
| you will have to ask someone for those values. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
37 changes: 37 additions & 0 deletions
37
auth/src/main/kotlin/gov/cdc/prime/reportstream/auth/client/OktaGroupsClient.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| package gov.cdc.prime.reportstream.auth.client | ||
|
|
||
| import com.okta.sdk.resource.api.ApplicationGroupsApi | ||
| import kotlinx.coroutines.Dispatchers | ||
| import kotlinx.coroutines.withContext | ||
| import org.apache.logging.log4j.kotlin.Logging | ||
| import org.springframework.stereotype.Service | ||
|
|
||
| @Service | ||
| class OktaGroupsClient( | ||
| private val applicationGroupsApi: ApplicationGroupsApi, | ||
| ) : Logging { | ||
|
|
||
| /** | ||
| * Get all application groups from the Okta Admin API | ||
| * | ||
| * Group names are found at json path "_embedded.group.profile.name" | ||
| * | ||
| * @see https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationGroups/#tag/ApplicationGroups/operation/listApplicationGroupAssignments | ||
| */ | ||
| suspend fun getApplicationGroups(appId: String): List<String> { | ||
| return withContext(Dispatchers.IO) { | ||
| try { | ||
| val groups = applicationGroupsApi | ||
| .listApplicationGroupAssignments(appId, null, null, null, "group") | ||
| .map { it.embedded?.get("group") as Map<*, *> } | ||
| .map { it["profile"] as Map<*, *> } | ||
| .map { it["name"] as String } | ||
| logger.info("$appId is a member of ${groups.joinToString()}") | ||
| groups | ||
| } catch (ex: Exception) { | ||
| logger.error("Error retrieving application groups from Okta API", ex) | ||
| throw ex | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.