CMS: Authentication

[kmranjo]

Generated from #826

User story: All users with a noaa.gov email are able to log in to the CMS with their noaa credentials or PIV card

Recommendations: Configure Drupal – Configure Drupal to function as a SAML Service Provider via a SAML IDP. Contrib modules such as SAML SP or SAML Authentication use the PHP-Saml library. Read more about various SAML options.

This work has already been done to some extent in most(all?) environments. The scope of this ticket is to fully implement it in beta and document the expected behavior for users.

Documentation should answer questions like:

• Do I use my noaa credentials or my piv card to log in?
• Can I log in from an off-network computer? Do I need to connect via the VPN?
• How soon after being granted a noaa email/noaa credentials will I be able to log in to the CMS?
• When noaa credentials are revoked, how long does it take for that user to no longer be able to log in to the CMS?

Documentation of these items has been added to the CMS Guide

[colinmurphy01]

@loganmcdonald-noaa Double checking. Can you confirm that beta supports ICAMS authentication?

If so, @kmranjo does this become a documentation ticket for onboarding/training?

[kmranjo]

Yeah maybe training and documentation?

[loganmcdonald-noaa]

Yes! This is done in beta.

On Mon, Mar 25, 2024 at 11:49 AM Katrina Ranjo @.***> wrote:

Yeah maybe training and documentation?

— Reply to this email directly, view it on GitHub https://github.com/weather-gov/weather.gov/issues/935#issuecomment-2018677707, or unsubscribe https://github.com/notifications/unsubscribe-auth/BCBVRY6G5BKN774WCDSREZ3Y2BWRZAVCNFSM6AAAAABFDJ7ZUGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJYGY3TONZQG4 . You are receiving this because you were mentioned.Message ID: @.***>

[colinmurphy01]

@kmranjo how will a user navigate to the CMS login page? Is it best practice to rely on a url? Should we consider a button in the header or footer for admins?

[kmranjo]

Yeah its usually just a specific URL that folks can bookmark.

[colinmurphy01]

Do you have an NWS location for hosting CMS documentation for users?

I can't recall if we've met with people from the training department. Do you wanna chat with them as part of this work?

[kmranjo]

@loganmcdonald-noaa I was assigned to this ticket for the documentation piece of it, but I don't actually know the answers to these questions yet. Are these things that you can speak to at all?

[loganmcdonald-noaa]

Do I use my noaa credentials or my piv card to log in?

You can use either, whichever you prefer!

Can I log in from an off-network computer? Do I need to connect via the VPN?

You should not need to connect to the VPN to access the site as long as you have your PIV or NOAA credentials.

How soon after being granted a noaa email/noaa credentials will I be able to log in to the CMS?

After you setup your NOAA account (https://accounts.noaa.gov/) you should be able to use those credentials to login. You need to connect your PIV to your NOAA account to use that to login (https://accounts.noaa.gov/register/#/)

When noaa credentials are revoked, how long does it take for that user to no longer be able to log in to the CMS?

Immediate, although it will not log them out right away if they are already logged in. A systems admin would have to log them out of our CMS if they are already logged in.

[kmranjo]

CMS guide addresses these topics, so this is ready in parallel with review of #936 Eng has reviewed, so this is more in the product arena now, to review for readability, does it address all it is intended to, etc.

[kmranjo]

Moved back to in progress while reworking the CMS guide

[kmranjo]

CMS guide has been reworked and is in a good place for re-review

[colinmurphy01]

I think the changes are awesome and make it easier for specific roles to see relevant guidance for them. So thank you for that!

The bummer is that with how much we're changing the CMS, we should call this done for now and will have to revisit when changes to data and UX are implemented.