From 470574e1971b47fe4e6329c8f701323c2116569e Mon Sep 17 00:00:00 2001 From: Kenneth Kehl <@kkehl@flexion.us> Date: Tue, 20 Feb 2024 08:28:26 -0800 Subject: [PATCH 1/5] enable login.gov link on demo and production and adjust test --- app/main/views/sign_in.py | 2 +- tests/app/main/views/test_sign_in.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py index be313c59b..853b33648 100644 --- a/app/main/views/sign_in.py +++ b/app/main/views/sign_in.py @@ -198,7 +198,7 @@ def sign_in(): form=form, again=bool(redirect_url), other_device=other_device, - login_gov_enabled=bool(notify_env in ["development", "staging"]), + login_gov_enabled=True, password_reset_url=password_reset_url, initial_signin_url=initial_signin_url, ) diff --git a/tests/app/main/views/test_sign_in.py b/tests/app/main/views/test_sign_in.py index 7970afa08..453790536 100644 --- a/tests/app/main/views/test_sign_in.py +++ b/tests/app/main/views/test_sign_in.py @@ -21,8 +21,8 @@ def test_render_sign_in_template_for_new_user(client_request): # Removing for the pilot # assert page.select('main a')[0].text == 'create one now' # assert page.select('main a')[0]['href'] == url_for('main.register') - assert page.select("main a")[0].text == "Forgot your password?" - assert page.select("main a")[0]["href"] == url_for("main.forgot_password") + assert page.select("main a")[1].text == "Forgot your password?" + assert page.select("main a")[1]["href"] == url_for("main.forgot_password") assert "Sign in again" not in normalize_spaces(page.text) From 4e32ef37b6515e04d3215e0ed8b39d6f8e93954b Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Tue, 20 Feb 2024 12:43:31 -0500 Subject: [PATCH 2/5] Adjust connectivity to Login.gov - Adds Login.gov to remaining egress proxies (both prototype and production URLs) - Swaps links to Login.gov to production environment Signed-off-by: Carlo Costino --- .github/workflows/deploy-demo.yml | 10 +++++----- .github/workflows/deploy.yml | 10 +++++----- deploy-config/egress_proxy/notify-admin-demo.allow.acl | 2 ++ .../egress_proxy/notify-admin-production.allow.acl | 2 ++ 4 files changed, 14 insertions(+), 10 deletions(-) diff --git a/.github/workflows/deploy-demo.yml b/.github/workflows/deploy-demo.yml index e1d76775a..bf9757493 100644 --- a/.github/workflows/deploy-demo.yml +++ b/.github/workflows/deploy-demo.yml @@ -56,12 +56,12 @@ jobs: NR_BROWSER_KEY: ${{ secrets.NR_BROWSER_KEY }} LOGIN_PEM: ${{ secrets.LOGIN_PEM }} LOGIN_DOT_GOV_CLIENT_ID: "urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov" - LOGIN_DOT_GOV_USER_INFO_URL: "https://idp.int.identitysandbox.gov/api/openid_connect/userinfo" - LOGIN_DOT_GOV_ACCESS_TOKEN_URL: "https://idp.int.identitysandbox.gov/api/openid_connect/token" - LOGIN_DOT_GOV_LOGOUT_URL: "https://idp.int.identitysandbox.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://notify-demo.app.cloud.gov/sign-out" - LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://idp.int.identitysandbox.gov/openid_connect/logout?" + LOGIN_DOT_GOV_USER_INFO_URL: "https://secure.login.gov/api/openid_connect/userinfo" + LOGIN_DOT_GOV_ACCESS_TOKEN_URL: "https://secure.login.gov/api/openid_connect/token" + LOGIN_DOT_GOV_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://notify-demo.app.cloud.gov/sign-out" + LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?" LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://notify-demo.app.cloud.gov/sign-out" - LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://idp.int.identitysandbox.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://notify-demo.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" + LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://notify-demo.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" with: cf_username: ${{ secrets.CLOUDGOV_USERNAME }} cf_password: ${{ secrets.CLOUDGOV_PASSWORD }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 767acae72..915994d58 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -62,12 +62,12 @@ jobs: NR_BROWSER_KEY: ${{ secrets.NR_BROWSER_KEY }} LOGIN_PEM: ${{ secrets.LOGIN_PEM }} LOGIN_DOT_GOV_CLIENT_ID: "urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov" - LOGIN_DOT_GOV_USER_INFO_URL: "https://idp.int.identitysandbox.gov/api/openid_connect/userinfo" - LOGIN_DOT_GOV_ACCESS_TOKEN_URL: "https://idp.int.identitysandbox.gov/api/openid_connect/token" - LOGIN_DOT_GOV_LOGOUT_URL: "https://idp.int.identitysandbox.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://notify-staging.app.cloud.gov/sign-out" - LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://idp.int.identitysandbox.gov/openid_connect/logout?" + LOGIN_DOT_GOV_USER_INFO_URL: "https://secure.login.gov/api/openid_connect/userinfo" + LOGIN_DOT_GOV_ACCESS_TOKEN_URL: "https://secure.login.gov/api/openid_connect/token" + LOGIN_DOT_GOV_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://notify-staging.app.cloud.gov/sign-out" + LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?" LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://notify-staging.app.cloud.gov/sign-out" - LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://idp.int.identitysandbox.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://notify-staging.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" + LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://notify-staging.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" with: cf_username: ${{ secrets.CLOUDGOV_USERNAME }} cf_password: ${{ secrets.CLOUDGOV_PASSWORD }} diff --git a/deploy-config/egress_proxy/notify-admin-demo.allow.acl b/deploy-config/egress_proxy/notify-admin-demo.allow.acl index 4718f99e7..41bf3a365 100644 --- a/deploy-config/egress_proxy/notify-admin-demo.allow.acl +++ b/deploy-config/egress_proxy/notify-admin-demo.allow.acl @@ -1,2 +1,4 @@ gov-collector.newrelic.com egress-proxy-notify-admin-demo.apps.internal +idp.int.identitysandbox.gov +secure.login.gov diff --git a/deploy-config/egress_proxy/notify-admin-production.allow.acl b/deploy-config/egress_proxy/notify-admin-production.allow.acl index 2173a6b4b..8103b0915 100644 --- a/deploy-config/egress_proxy/notify-admin-production.allow.acl +++ b/deploy-config/egress_proxy/notify-admin-production.allow.acl @@ -1,2 +1,4 @@ gov-collector.newrelic.com egress-proxy-notify-admin-production.apps.internal +idp.int.identitysandbox.gov +secure.login.gov From 92fc35b6f60b2349f7a83f47d84c6f3d85022ba2 Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Mon, 26 Feb 2024 17:39:33 -0500 Subject: [PATCH 3/5] Only enable Login.gov link for demo right now We are holding off on production until we have a chance to share more information with pilot partners. Signed-off-by: Carlo Costino --- app/main/views/sign_in.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py index 853b33648..c6eaee87e 100644 --- a/app/main/views/sign_in.py +++ b/app/main/views/sign_in.py @@ -198,7 +198,7 @@ def sign_in(): form=form, again=bool(redirect_url), other_device=other_device, - login_gov_enabled=True, + login_gov_enabled=bool(notify_env in ["development", "staging", "demo"]), password_reset_url=password_reset_url, initial_signin_url=initial_signin_url, ) From f8b8dd5fb3018f428c57563d08d1b9e187347c5b Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Mon, 26 Feb 2024 17:59:18 -0500 Subject: [PATCH 4/5] Fix broken test and include note about why Signed-off-by: Carlo Costino --- tests/app/main/views/test_sign_in.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/app/main/views/test_sign_in.py b/tests/app/main/views/test_sign_in.py index 453790536..5675946dc 100644 --- a/tests/app/main/views/test_sign_in.py +++ b/tests/app/main/views/test_sign_in.py @@ -21,8 +21,10 @@ def test_render_sign_in_template_for_new_user(client_request): # Removing for the pilot # assert page.select('main a')[0].text == 'create one now' # assert page.select('main a')[0]['href'] == url_for('main.register') - assert page.select("main a")[1].text == "Forgot your password?" - assert page.select("main a")[1]["href"] == url_for("main.forgot_password") + # TODO: Fix this test to be less brittle! If the Login.gov link is enabled, + # then these indices need to be 1 instead of 0. + assert page.select("main a")[0].text == "Forgot your password?" + assert page.select("main a")[0]["href"] == url_for("main.forgot_password") assert "Sign in again" not in normalize_spaces(page.text) From 6ec0de4b63abc456c0f491f942094005c85f26cd Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Mon, 26 Feb 2024 18:07:26 -0500 Subject: [PATCH 5/5] One final note about why the test is brittle Signed-off-by: Carlo Costino --- tests/app/main/views/test_sign_in.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/app/main/views/test_sign_in.py b/tests/app/main/views/test_sign_in.py index 5675946dc..f85c756ea 100644 --- a/tests/app/main/views/test_sign_in.py +++ b/tests/app/main/views/test_sign_in.py @@ -23,6 +23,7 @@ def test_render_sign_in_template_for_new_user(client_request): # assert page.select('main a')[0]['href'] == url_for('main.register') # TODO: Fix this test to be less brittle! If the Login.gov link is enabled, # then these indices need to be 1 instead of 0. + # Currently it's not enabled for the test or production environments. assert page.select("main a")[0].text == "Forgot your password?" assert page.select("main a")[0]["href"] == url_for("main.forgot_password") assert "Sign in again" not in normalize_spaces(page.text)