datatools-ui icon indicating copy to clipboard operation
datatools-ui copied to clipboard

Auth0 react

Open binh-dam-ibigroup opened this issue 2 years ago • 4 comments

Checklist

  • [x] Appropriate branch selected => Using react-17 because it has react 16+ required by @auth0/auth0-react.
  • [x] Any modified or new methods or classes have helpful JSDoc and code is thoroughly commented
  • [x] The description lists all applicable issues this PR seeks to resolve
  • [x] The description lists any configuration setting(s) that differ from the default settings
  • [ ] All tests and CI builds passing

Description

This PR update the auth0 authentication library and refactors code accordingly. Fix #518, Fix #335.

New front-end configuration parameters:

  • AUTH0_CONNECTION_NAME: the name of the Auth0 connection used for logging in.

Required backend configuration parameters:

  • AUTH0_PUBLIC_KEY must now be provided (AUTH0_SECRET will no longer be used).

Required changes in the Auth0 tenant:

  • The algorithm for encoding the token must be set to RS256 (this is required by the @auth0/auth0-react library).

binh-dam-ibigroup avatar Aug 09 '22 22:08 binh-dam-ibigroup

I'm now able to log in, but until I think this should stay blocked until we can confirm that the permissions screen can be removed and that user permissions can be migrated to the new auth0 config.

miles-grant-ibigroup avatar Aug 17 '22 15:08 miles-grant-ibigroup

I'm now able to log in, but until I think this should stay blocked until we can confirm that the permissions screen can be removed and that user permissions can be migrated to the new auth0 config.

I did create a new client id for dev purposes, but one thing we can do once this is ready is to update the token algorithms on the current client, so that existing users don't need to be migrated.

binh-dam-ibigroup avatar Aug 17 '22 15:08 binh-dam-ibigroup

Would this remove the permissions approval screen as well?

miles-grant-ibigroup avatar Aug 17 '22 15:08 miles-grant-ibigroup

Would this remove the permissions approval screen as well?

Per these docs, the authorization screen can be skipped, except where localhost appears in the auth0 application settings.

binh-dam-ibigroup avatar Aug 17 '22 16:08 binh-dam-ibigroup