Update authentication configuration to use OIDC

bferguso commented 6 months ago

BCGov docs: Old URL - https://github.com/bcgov/sso-keycloak/wiki New URL - https://mvp.developer.gov.bc.ca/docs/default/component/css-docs

[x] Request OIDC service from BC Registries. Done: https://github.com/bcgov/entity/issues/21865
[x] Implement configuration.
[x] Open firewall rules for ENDOWMENT.bcgov and EARLY.bcgov to allow connection to OIDC servers. Request made: https://apps.nrs.gov.bc.ca/int/jira/browse/BCRHP-114

Implementation Notes

Using the preferred username returned from the OIDC server as the UID claim. The value differs between formats for DLVR (<username>@idir) and TEST/PROD (idir\<username>)
Translating the UID claim into the <username>@idir format to allow adding of users via the django admin tool. Usernames must be in lower case
Users must exist in BCRHP for a user to be authorised to use the system (no self registration allowed)
Unauthorised, authenticated users are redirected to an unauthorized page with a link back into the system or to the Historic Places website

bferguso commented 5 months ago

Confirmed with NRIDS Security that Pathfinder / BCGov SSO is an option. Received the following confirmation on March 13th:

In short, for developer Brett Ferguson, NRIDS Security has no objections to adoption and use of Pathfinder / BC Gov Common Hosted SSO for an NRIDS hosted/supported app.

bferguso commented 4 months ago

Dicussions have been had with Corporate Registries to allow us to use their services. Approvals have also been completed and we're now waiting for implementation details.

bferguso commented 3 months ago

This is functioning in DEV, however firewall rules are preventing it from functioning on the BCGov servers. I have submitted a JIRA request to change the firewall rules to allow a connection to the OIDC from our servers: https://apps.nrs.gov.bc.ca/int/jira/browse/BCRHP-114

FYI @emjohnst

bferguso commented 2 months ago

@emjohnst - This is mostly working, however there seems to be another server in the OIDC redirect chain that we don't have access to. I'll contact BC Registries in the morning to see if I can get a full list for the next NRIDS request.

Also, is showing the other authentication methods (BCeID, GitHub, etc) a deal breaker for this release? If so, we'll need to do more work to make that happen.

emjohnst commented 2 months ago

Done in test

bcgov / BCHeritage

Update authentication configuration to use OIDC #910