search

alan-turing-institute / WimbledonPlanner

Project planning for REG
MIT License
0 stars 0 forks source link

Allow access to app for Turing folk from offsite #44

Closed jack89roberts closed 4 years ago

jack89roberts commented 5 years ago

Currently the Azure app is restricted to Turing IP addresses, but open to anyone trying to access it whilst at the Turing.

As a first pass to making the app accessible to Turing folk offsite, we'll incorporate Azure Active directory login.

Note that this is still fairly "hacky" as the app is accessing Github and Harvest with credentials many users with Turing AAD credentials will not have. See issue #50 as placeholder for improvements to authentication.

martintoreilly commented 4 years ago

Let's use Azure AD - see https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad#-configure-with-advanced-settings

Progress

Azure AD Enterprise app setup

Azure app service AAD login configuration

Open up network access rules

martintoreilly commented 4 years ago

Testing

martintoreilly commented 4 years ago

@jack89roberts Please could you review the above and let me know if (i) any of the instructions are not clear and (ii) do some ad-hoc testing of your own to confirm access control works as you expect.

jack89roberts commented 4 years ago

Nice! It works on my phone (using mobile data) as well - asks me to login and then the app works as normal afterwards.

The only thing I'm unsure about in the instructions is this part:

Azure AD Enterprise app setup

  • Check the "Access tokens" and "ID tokens" boxes under "Authentication -> Implicit grant" (or equivalently set "oauth2AllowIdTokenImplicitFlow": true and "oauth2AllowImplicitFlow": true in the app manifest)
  • Set the redirect URL to https://wimbledon-planner.azurewebsites.net/.auth/login/aad/callback

Where are these settings and are we supposed to have access to them or is it part of what IT sets up (e.g. if it's in "App registrations" then I get a "you do not have access" error back)?

martintoreilly commented 4 years ago

It's part of the set up IT do for the AD enterprise app. I've updates the notes to reflect this.

jack89roberts commented 3 years ago

The app registration expired and had to be renewed. These are the steps for renewing it:

I then restarted the app service, but I'm not sure whether this is necessary.

yongrenjie commented 8 months ago

16/1/2024: Client secret was renewed. The steps are similar to above, but the Azure interface is slightly different:

  1. Bug IT to send a new client secret. (This was surprisingly difficult: they initially told me to go to Tomas, but the Active Directory secrets are managed by IT, not by Research Computing, so you may have to insist that they do it. In my case, Tomas got them to sort it out, thanks Tomas 😄)
  2. (Same as above) Go to the wimbledon-planner key vault in the wimbledon-planner-production resource group. From the left menu, select Objects > Secrets. Click on app-secret and create a new version
  3. In the wimbledon-planner App Service, select Settings > Configuration, and select Application Settings from the tabs in that page. Click on MICROSOFT_PROVIDER_AUTHENTICATION_SECRET and paste the new secret as the value there.
    • You can also do this from Settings > Authentication, and editing the Wimbledon-Planner identity provider in the list shown there. It brings you to the same screen.

Wait a couple of minutes and the app should work. I didn't need to restart it.

jack89roberts commented 8 months ago

Thanks Jon!