Authorization strategy and implementation for submissions endpoint

jalbinson commented 2 months ago

User Story

As a sender onboarded to ReportStream, I want to be authorized to hit the submissions endpoint

Description/Use Case

We want to only allow authorized senders to hit the submissions endpoint.

Risks/Impacts/Considerations

A nefarious user could submit false reports which could skew public health data.

Dev Notes

Look into custom claims block in Okta to see if its easily possible to inject the org name for easy comparison during authorization check
Reports in send step may contain thousands of items so a single event wont be able to hold all the condition data. One option is to create a "ItemSentEvent" for each ITEM in the report.

Acceptance Criteria

Decide under which Okta authorization server clients orgs should live
Scopes and extra claims clearly defined for organizational users
~Authz strategy implemented for submission endpoint (probably @PreAuthorize annotation)~
- 16183 handles this now
Come up with approach for authorization in Azure Functions app that does not depend on Spring
unit tests

Andrey-Glazkv commented 2 months ago

Hey team! Please add your planning poker estimate with Zenhub @adegolier @arnejduranovic @brick-green @david-navapbc @jack-h-wang @jalbinson @JFisk42 @mkalish @thetaurean

dylansmith-Nava commented 2 months ago

Linking some of the prior research here:

Identity proofing new senders slide deck (a bit prescriptive, but helpful for context)
General authentication and verification research folder
Authentication and verification Mural

The general understanding of the research was that verification by Okta to securely log into and use the RS platform =/= "you are who you say you are". That is, you could be verified by Okta but still be a shady organization that we know nothing about. To really know whether an organization is or isn't nefarious, we'd need a level of Identity Proofing which we don't have yet.

So it's important to point out that this ticket would NOT mitigate or reduce the only stated risk.

jalbinson commented 1 month ago

Decisions made in this ticket are documented in the UP SRD under "Authorization Service Software Requirements"

arnejduranovic commented 1 month ago

The SRD this ticket updated will be implemented here: https://github.com/CDCgov/prime-reportstream/issues/14601

CDCgov / prime-reportstream