DUO Mode: Switch on DUO Mode for Existing and New Customers

[zcolah]

Problem Customers do not know about DUO Mode and how to start it. We just want to start it for existing customers and new customers/instance in the future.

Solution Steps Specifically this solution is based around a content policy setting.

• [x] 1. @giseleblair Please document the solution or assign someone to document this
• [ ] 2. There needs to be a change made to the product by the manager ui team to allow for the value that @giseleblair has documented. If there are any questions on how to go about this please ask @shrunyan.
• [x] 3. We need to bake that value into the starter blue print, and into all of the existing templates. We want to make DUO mode the default experience for all of the templates.
• [ ] 4. Once we complete this solution, we will lead an outreach effort to existing customers where we inform them of DUO mode, and the steps they need to set it up along with an option for a training/setup call.

[agalin920]

@zcolah DUO mode is turned on by default if they have it enabled

[zcolah]

@agalin920 this is a ticket that is WIP with Randy. Not yet assigned to any developers therefore.

[giseleblair]

The following settings would be the ideal values to allow to use DUO mode within the product: Settings: Header: X-Frame-Options Content-Security-Policy Referrer-Policy

[agalin920]

These settings when present disable duomode setting.key === "basic_content_api_key" setting.key === "headless_authorization_key" setting.key === "authorization_key" setting.key === "x_frame_options"

[allenpigar]

@giseleblair @agalin920 i already create a branch (https://github.com/zesty-io/template-pomelo/tree/enable-duo-mode) for this, removing the setting to enable duo mode but the installer template installation does not support deletion of settings. it only updates or creates settings. with this, i think we must also need to delete those settings on the "template base blueprint" since this blueprint creates the base or default setting for the instance before the installer updates or creates the settings for template.

[giseleblair]

I believe that template base blueprint only exists in the database, can you confirm @allenpigar

[allenpigar]

@giseleblair yes it exist on the database and sql scripts are need to update. but as we have discussed, there no need to remove those settings and just set the default value to null. with this, we can just update the values on the template itself without any changes on the blueprint. i already created pr for review.

https://github.com/zesty-io/template-blank/pull/2 https://github.com/zesty-io/template-simple-blog/pull/1 https://github.com/zesty-io/template-pomelo/pull/3

[finnar-bin]

@giseleblair it seems like there's nothing needed to done in manager-ui for this ticket anymore as I tried creating new instances using all the existing templates are they all have duo mode enabled by default already.

I checked in with @allenpigar and he has confirmed that he changed the template's default values for the following settings (basic_content_api_key, headless_authorization_key, authorization_key and x_frame_options) to null which is what manager-ui needs for duo mode to be enabled. Therefore it doesn't seem like any work needs to be done in the manager-ui since the changes that Allen made already enables duo mode by default for newly-created instances.

[giseleblair]

@finnar-bin please refer to my screenshot above in the thread (from Jan 3) and test with those values. Duo mode needs to work with the those values not just the null values from the templates

[finnar-bin]

@giseleblair so just to clarify, the goal here is to make sure that duo mode is activated if those settings are either null or contain the specific values you mentioned?

[giseleblair]

@finnar-bin Duo mode does not get activated by these settings. But the goal is that when Duo Mode is turned on, AND the above settings are either null or the specific mentioned values that the Duo Mode frame will render the page as expected. Currently, the values MIUST be null in order for the Duo Mode frame to render. But we want to update this logic so it will also work with the mentioned values.

[finnar-bin]

Note to self: CSP needs to be validated as well

[finnar-bin]

@giseleblair is there a need to validate that the value for Referrer-Policy be either null or "strict-origin-when-cross-origin" for the duo mode toggle to be visible?

I've already tested the CSP setting and it seems like what works is frame-ancestors 'self' *.zesty.io for the iframe to be rendered within manager-ui but not elsewhere.

[giseleblair]

I believe that CSP will trump the Referrer-Policy value @finnar-bin but it is still worth validating in the order of operations