Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MMT-3568: Setup a lambda for launchpad login/callbacks #1109

Merged
merged 4 commits into from
Jan 26, 2024
Merged

Conversation

cgokey
Copy link
Collaborator

@cgokey cgokey commented Jan 25, 2024

PR focuses on the lambdas only. The workflow is as follows:

  1. Web Client requests to login via https://api.mmt.sit.earthdatacloud.nasa.gov/saml-login (lambda) and includes a ?target to the route path which they should be returned to.
  2. saml-login lambda generates a authorizationUrl using the node-saml package. The lambda will then redirect to this launchpad authorization url and will include: the relayState (target to return to), callback url (endpoint is another lambda), along with a number of key/values needed by launchpad for authentication (found in static.config.js)
  3. saml-acs is a lambda that responds to the launchpad callback. The launchpad token is found in the header. It needs to parse the body of the response to pull out details such as email, auid, etc. This is an encoded response, so it uses the Saml2js to parse out these details. It then takes all this information and create a JWT token and will pass (via redirect) this token to the MMT React Application as a jwt query parameters in the URL.
  4. The MMT React Application will then parse jwt query parameter, pull out the launchpad token and use this for CMR graphql queries. (This implementation will follow in a separate ticket).

Couple things to note:

  1. static.config.js includes a cert key. The node-saml package requires a value here. Although I looked through the rails mmt code and it nowhere uses this cert for logging in. It only uses the cert for validating a launchpad token. So right now I'm just using fake_cert as a value and not seeing any issues testing locally.
  2. We will need to put in a request to launchpad to allow requests to come from api.mmt.[sit|uat].earthdatacloud.nasa.gov and include respective callback urls for any of the above to work. I tested all this using a local version using mmt.localtest.earthdata.nasa.gov to verify the code works and properly authenticates. (these urls are currently registered with launchpad).

package-lock.json Outdated Show resolved Hide resolved
package-lock.json Show resolved Hide resolved
@cgokey cgokey merged commit f1adde0 into MMT-3390 Jan 26, 2024
5 checks passed
@cgokey cgokey deleted the MMT-3568 branch January 26, 2024 16:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants