SPIKE - Investigate options for AzureAD with AWS API Gateway

[PriyaBasker23]

User Story

As a data producer / controller I want to securely register data product and upload data

Value / Purpose

The existing authentication functionality relies on a single token verification within the Lambda authorizer. This setup lacks robust security since it doesn't allow us to track the user who uploaded data using a presigned URL.

To address this, we are initiating a spike to explore the integration of Azure AD with the API Gateway for the purpose of forwarding JWT tokens.

Hypothesis

We plan to implement user authentication by utilizing Azure AD in conjunction with the API Gateway.

Checklist

• [ ] Please follow the guidelines outlined in the article at https://awskarthik82.medium.com/how-to integrate-azuread-b2c-with-aws-api-gateway-jwt-authorizer-26d7534399a.

• [ ] Utilise the RestAPI and create a custom authorizer since a JWT authorizer is not an option for REST API.

• [ ] The focus of this ticket is solely on authenticating users. The permission model is outside the scope of this task.

• [ ] Build temporary localhost client page for App reg

• [ ] If you don't have permission to reg apps in Azure Ad, please get help ( @jemnery )

Definition of Done

• [ ] Complete POC
• [ ] Get it Reviewed with TA ( @jemnery )

[YvanMOJdigital]

make sure to check in with appsandtools

[PriyaBasker23]

Spoke to Julia and this is the agreed plan @YvanMOJdigital @julialawrence

1. I've will be working on a Proof of Concept (POC) for the authentication component within a custom Lambda, covering both the client's and user's data journey.
2. Meeting with Julia and Jeremy during the Tuesday meeting to discuss this, and hopefully, we'll have the POC completed by then.
3. Our plan is to develop a microservice that will be deployed in the Kubernetes cluster, providing both authentication and authorisation capabilities ( This will in the following sprint ).
4. The Labs team will collaborate with DPAT to implement the authentication component, while the authorisation implementation will be handled by DPAT.