Skip to content
This repository has been archived by the owner on May 7, 2024. It is now read-only.

B 17159 okta secret management #9

Merged
merged 2 commits into from
Aug 11, 2023
Merged

B 17159 okta secret management #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5a394aa
re-committing without verifying with lint due to needing review errors
danieljordan-caci Aug 10, 2023
72ab970
added okta tenant url to chamber and adjusted .envrc to allow for eas…
danieljordan-caci Aug 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .envrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,28 @@ export LOGIN_GOV_HOSTNAME="idp.int.identitysandbox.gov"

require LOGIN_GOV_SECRET_KEY "See 'DISABLE_AWS_VAULT_WRAPPER=1 AWS_REGION=us-gov-west-1 aws-vault exec transcom-gov-dev -- chamber read app-devlocal login_gov_secret_key'"

# Okta.mil configuration

# Tenant
require OKTA_TENANT_ORG_URL "See 'DISABLE_AWS_VAULT_WRAPPER=1 AWS_REGION=us-gov-west-1 aws-vault exec transcom-gov-dev -- chamber read app-devlocal okta-tenant-org-url'"
export OKTA_TENANT_CALLBACK_PORT=443
export OKTA_TENANT_CALLBACK_PROTOCOL=https

# Customer
require OKTA_CUSTOMER_SECRET_KEY "See 'DISABLE_AWS_VAULT_WRAPPER=1 AWS_REGION=us-gov-west-1 aws-vault exec transcom-gov-dev -- chamber read app-devlocal okta-customer-secret-key'"
export OKTA_CUSTOMER_CLIENT_ID=0oa3jalqz3iCyRT9i0k6
export OKTA_CUSTOMER_CALLBACK_URL=http://milmovelocal:3000/auth/login-gov/callback

# Office
require OKTA_OFFICE_SECRET_KEY "See 'DISABLE_AWS_VAULT_WRAPPER=1 AWS_REGION=us-gov-west-1 aws-vault exec transcom-gov-dev -- chamber read app-devlocal okta-office-secret-key'"
export OKTA_OFFICE_CLIENT_ID=0oa3j8zgqkIUDrhOy0k6
export OKTA_OFFICE_CALLBACK_URL=http://officelocal:3000/auth/login-gov/callback

# Admin
require OKTA_ADMIN_SECRET_KEY "See 'DISABLE_AWS_VAULT_WRAPPER=1 AWS_REGION=us-gov-west-1 aws-vault exec transcom-gov-dev -- chamber read app-devlocal okta-admin-secret-key'"
export OKTA_ADMIN_CLIENT_ID=0oa3j9kbaTicDz0az0k6
export OKTA_ADMIN_CALLBACK_URL=http://adminlocal:3000/auth/login-gov/callback

# JSON Web Token (JWT) config
CLIENT_AUTH_SECRET_KEY=$(cat config/tls/devlocal-client_auth_secret.key)
export CLIENT_AUTH_SECRET_KEY
Expand Down
67 changes: 43 additions & 24 deletions pkg/cli/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,33 +39,52 @@ const (
// LoginGovHostnameFlag is the Login.gov Hostname Flag
LoginGovHostnameFlag string = "login-gov-hostname"

// ! Verify wording after changes
// Okta flags for local development environment that serves test-milmove.okta.mil
// Okta tenant flags
/*
OktaTenantIssuerURLFlag string = "okta-tenant-issuer-url"
OktaTenantCallbackPortFlag string = "okta-tenant-callback-port"
*/
OktaTenantOrgURLFlag string = "okta-tenant-org-url"
// OktaTenantCallbackPortFlag is the test-milmove Callback Port Flag
OktaTenantCallbackPortFlag string = "okta-tenant-callback-port"
// OktaTenantCallbackPortFlag is the test-milmove Callback Protocol Flag
OktaTenantCallbackProtocolFlag string = "okta-tenant-callback-protocol"

// Okta Customer client id and secret flags
/*
OktaCustomerSecretKeyFlag string = "okta-customer-secret-key"
OktaCustomerClientIDFlag string = "okta-customr-client-id"
OktaCustomerHostnameFlag string = "okta-customer-hostname"
OktaCustomerCallbackProtocolFlag string = "okta-customer-callback-protocol"
*/
OktaCustomerClientIDFlag string = "okta-customer-client-id"
// RA Summary: gosec - G101 - Password Management: Hardcoded Password
// RA: This line was flagged because of use of the word "secret"
// RA: This line is used to identify the name of the flag. OktaCustomerSecretKeyFlag is the Okta Customer Application Secret Key Flag.
// RA: This value of this variable does not store an application secret.
// RA Developer Status: RA Request
// RA Validator Status:
// RA Validator:
// RA Modified Severity:
// #nosec G101
OktaCustomerSecretKeyFlag string = "okta-customer-secret-key"

// Okta Office client id and secret flags
/*
OktaOfficeSecretKeyFlag string = "okta-office-secret-key"
OktaOfficeClientIDFlag string = "okta-office-client-id"
OktaOfficeHostnameFlag string = "okta-office-hostname"
OktaOfficeCallbackProtocolFlag string = "okta-office-callback-protocol"
*/
OktaOfficeClientIDFlag string = "okta-office-client-id"
// RA Summary: gosec - G101 - Password Management: Hardcoded Password
// RA: This line was flagged because of use of the word "secret"
// RA: This line is used to identify the name of the flag. OktaOfficeSecretKeyFlag is the Okta Office Application Secret Key Flag.
// RA: This value of this variable does not store an application secret.
// RA Developer Status: RA Request
// RA Validator Status:
// RA Validator:
// RA Modified Severity:
// #nosec G101
OktaOfficeSecretKeyFlag string = "okta-office-secret-key"

// Okta Admin client id and secret flags
/*
OktaAdminSecretKeyFlag string = "okta-admin-secret-key"
OktaAdminClientIDFlag string = "okta-admin-client-id"
OktaAdminHostnameFlag string = "okta-admin-hostname"
OktaAdminCallbackProtocolFlag string = "okta-admin-callback-protocol"
*/
OktaAdminClientIDFlag string = "okta-admin-client-id"
// RA Summary: gosec - G101 - Password Management: Hardcoded Password
// RA: This line was flagged because of use of the word "secret"
// RA: This line is used to identify the name of the flag. OktaAdminSecretKeyFlag is the Okta Admin Application Secret Key Flag.
// RA: This value of this variable does not store an application secret.
// RA Developer Status: RA Request
// RA Validator Status:
// RA Validator:
// RA Modified Severity:
// #nosec G101
OktaAdminSecretKeyFlag string = "okta-admin-secret-key"
)

type errInvalidClientID struct {
Expand All @@ -91,7 +110,7 @@ func InitAuthFlags(flag *pflag.FlagSet) {
// TODO: Replace Okta os.Getenv

// // Okta flags
// flag.String(OktaTenantIssuerURLFlag, os.Getenv("OKTA_TENANT_ISSUER_URL"), "Okta tenant issuer URL.")
// flag.String(OktaTenantIssuerURLFlag, os.Getenv("OKTA_TENANT_ORG_URL"), "Okta tenant issuer URL.")
// flag.Int(OktaTenantCallbackPortFlag, 443, "Okta tenant callback port.")

// // Customer flags
Expand Down
9 changes: 4 additions & 5 deletions pkg/handlers/authentication/okta/provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,26 +144,25 @@ func wrapOktaProvider(provider *gothOkta.Provider, logger *zap.Logger) *Provider
}

// Function to register all three providers at once.
// TODO: Use viper instead of os environment variables
func (op *Provider) RegisterProviders() error {

// Declare OIDC scopes to be used within the providers
scope := []string{"openid", "email", "profile"}

// Register customer provider
err := op.RegisterOktaProvider(MilProviderName, os.Getenv("OKTA_CUSTOMER_HOSTNAME"), os.Getenv("OKTA_CUSTOMER_CALLBACK_URL"), os.Getenv("OKTA_CUSTOMER_CLIENT_ID"), os.Getenv("OKTA_CUSTOMER_SECRET_KEY"), scope)
// Register customer provider and pull values from env variables
err := op.RegisterOktaProvider(MilProviderName, os.Getenv("OKTA_TENANT_ORG_URL"), os.Getenv("OKTA_CUSTOMER_CALLBACK_URL"), os.Getenv("OKTA_CUSTOMER_CLIENT_ID"), os.Getenv("OKTA_CUSTOMER_SECRET_KEY"), scope)
if err != nil {
op.logger.Error("Could not register customer okta provider", zap.Error(err))
return err
}
// Register office provider
err = op.RegisterOktaProvider(OfficeProviderName, os.Getenv("OKTA_OFFICE_HOSTNAME"), os.Getenv("OKTA_OFFICE_CALLBACK_URL"), os.Getenv("OKTA_OFFICE_CLIENT_ID"), os.Getenv("OKTA_OFFICE_SECRET_KEY"), scope)
err = op.RegisterOktaProvider(OfficeProviderName, os.Getenv("OKTA_TENANT_ORG_URL"), os.Getenv("OKTA_OFFICE_CALLBACK_URL"), os.Getenv("OKTA_OFFICE_CLIENT_ID"), os.Getenv("OKTA_OFFICE_SECRET_KEY"), scope)
if err != nil {
op.logger.Error("Could not register office okta provider", zap.Error(err))
return err
}
// Register admin provider
err = op.RegisterOktaProvider(AdminProviderName, os.Getenv("OKTA_ADMIN_HOSTNAME"), os.Getenv("OKTA_ADMIN_CALLBACK_URL"), os.Getenv("OKTA_ADMIN_CLIENT_ID"), os.Getenv("OKTA_ADMIN_SECRET_KEY"), scope)
err = op.RegisterOktaProvider(AdminProviderName, os.Getenv("OKTA_TENANT_ORG_URL"), os.Getenv("OKTA_ADMIN_CALLBACK_URL"), os.Getenv("OKTA_ADMIN_CLIENT_ID"), os.Getenv("OKTA_ADMIN_SECRET_KEY"), scope)
if err != nil {
op.logger.Error("Could not register admin okta provider", zap.Error(err))
return err
Expand Down