A Python Flask implementation of an SSO dashboard with OIDC for authentication.
High-Level Architecture Diagram of the Dashboard and related services. Diagram source is available here.
The dashboard prototype as it exists today. This screenshot will be updated as the dashboard UI evolves.
All authentications are performed through Auth0 for all users.
This app does not technically provide authorization. However, it does check a file using rule syntax to determine what applications should be in the user's dashboard. The rule file exists in dashboard/data/apps.yml.
---
apps:
- application:
name: "Demo App 1"
op: auth0
aal: LOW
url: "https://foo.bar.com"
logo: "auth0.png"
authorized_users: []
authorized_groups: []
display: false
vanity_url:
- /demo
During authorization, the app checks the user's group membership. If a user is a member of the required groups and they exist in their profile, the user is shown the icon.
Note: The display false attribute will cause the app not to be displayed at all under any circumstance. This exists largely to facilitate dev apps or app staging and then taking apps live.
To add applications to the dashboard, create an application entry in the apps.yml
file and add a logo under the images directory.
https://github.com/mozilla-iam/sso-dashboard-configuration
These are the rules for the logos. They have to conform to some standards due to the fact they are in a responsive grid.
For more information on developing features for the SSO Dashboard, see the development guide.
This section gives an overview of the SSO Dashboard deployment. For a more detailed explanation, check this document.
The Single Sign-On (SSO) Dashboard runs on GCP Cloud Run and is automatically deployed to a Cloud Deploy pipeline via GitHub Actions upon merging to the master branch. Once deployed to Cloud Deploy, it becomes immediately available in the Cloud Run development environment for smoke testing. The IAM team can then promote the build from development to staging for further testing, and subsequently to production when ready.
Cloud Run environments:
Each Cloud Run environment's settings are located in the clouddeploy
directory.