ConnectID Initial Implementation #2660

OrangeAndGreen · 2023-04-12T18:06:39Z

Summary

Initial development of ConnectID functionality, including registration workflow.

Feature Flag

CommCare Connect

Product Description

When enabled, adds UI methods to LoginController for user to sign in to ConnectID.
First-time user can create an account with the Connect server.

Safety Assurance

If the PR is high risk, "High Risk" label is set
I have confidence that this PR will not introduce a regression for the reasons below
Do we need to enhance manual QA test coverage ? If yes, "QA Note" label is set correctly

Automated test coverage

No tests.

Safety story

This code is disabled by a hard-coded boolean at the top of the ConnectIDManager class, and when disabled results in no changes to existing functionality.

cross-request: dimagi/commcare-core#1318

Getting ready for network calls.

Initial registration workflow working. Implemented basic photos page and SMS verification.

Basic password manager implementation after ConnectID login.

shubham1g5 · 2023-04-12T18:19:34Z

@OrangeAndGreen Is it possible to add screenshots for different screens this PR adds in the description in order to get more context around the functionality here. Thanks!

Implemented local encrypted DB for data related to Connect.

app/build.gradle

Some cleanup after achieving POC functionality. Using secure storage for password manager functionality.

…ation call.

Several UI improvements, rewording.

A couple small bug fixes. Preparing for OIDC calls.

Moved ConnectID activities into a sub-namespace called connect.

Showing recovery phone number in UI when sending alt OTP.

OrangeAndGreen · 2023-06-09T15:13:53Z

cross-request: dimagi/commcare-core#1290

Now encrypting DB passphrase using a Cipher, and storing the encrypted passphrase in the global DB. Added table to global DB for storing ConnectKeyRecords (changed DB version to 6). Min SDK Version moved back to 16 now that we aren't using newer helper classes (EncryptedFile, MasterKeys).

OrangeAndGreen · 2023-06-13T17:35:45Z

The various workflows are detailed via screenshots here.

Not allowing password option when prompting for biometric unlock during registration. Fixed bug where ConnectID button on login page would appear after logging out of an app even if ConnectID user was not configured. Disabled auto-login to app after unlocking ConnectID.

…ing a broken test).

Checking if ConnectID is unlocked before retrieving SSO token. No null check on passphrase when retrieving from global DB.

…till use RSA after upgrading to API >=31).

shubham1g5

Very minor comments, looks quite close to merge. Can we resolve conflicts as well on this.

shubham1g5 · 2023-08-21T16:46:41Z

app/src/org/commcare/utils/EncryptionUtils.java

@@ -69,18 +69,29 @@ private static KeyStore getKeystore() throws KeyStoreException, CertificateExcep
        return keystoreSingleton;
    }



couple nits on this class-

The Javadoc on this class seems misleading with the new changes in this class, can we modify it in accordance with the new functionality in this class.

can we lint/format the code with CC style files.

shubham1g5 · 2023-08-21T16:55:38Z

app/src/org/commcare/utils/EncryptionUtils.java

+            return keyGenerator.generateKey();
+        }
+        else {
+            KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA", KEYSTORE_NAME);


user upgrades from API <31 to >=31.

should be when upgrading across API 23 right ?

A caveat of this solution is that we'll continue using RSA encryption after the user upgrades their OS

I am fine with this for now. I anticipate very few upgrades at this time for api 23 practically and just ensuring user is not locked from their data should be good enough handling for this case.

shubham1g5 · 2023-08-21T17:05:35Z

app/src/org/commcare/utils/EncryptionUtils.java

        String transformation;
-        if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M) {
-            transformation = String.format("%s/%s/%s", ALGORITHM, BLOCK_MODE, PADDING);
+        if (forceRSA || android.os.Build.VERSION.SDK_INT < android.os.Build.VERSION_CODES.M) {


The android version check doesn't seem to be meaningful now to me. We can probably just decide the transformation based on forceRSA ?

Yup, you're right, forceRSA will always be true for API<M. But we get a compile warning about using the ALGORITHM, BLOCK_MODE, and PADDING constants if I remove that check, so I left it there to keep the compiler happy. Would it be better to remove it and ignore/suppress the warning?

Would it be better to remove it and ignore/suppress the warning?

Yeah I would support that since we are already doing this check outside to determine forceRSA

Done, I removed the extra API check and suppressed the warning.

shubham1g5 · 2023-08-21T17:09:40Z

app/src/org/commcare/activities/connect/ConnectIDNetworkHelper.java

                isBusy = false;
+                dismissProgressDialog(context);


can abstract this into another internal method something like - onFinishProcessing()

Improved EncryptionUtils documentation, fixed a couple lint warnings, and reformatted code. Abstracted onFinishProcessing function in ConnectIDNetworkHelper.

…droid into dv/connect_id

shubham1g5 · 2023-08-23T14:07:28Z

@OrangeAndGreen the changes looks good though the build seems to be failing on Jenkins.

…sed runtime crash).

…nto dv/connect_id

…xposed via CommCareApplication. Created MockEncryptionKeyProvider to allow encryption without Keystore in tests.

shubham1g5 · 2023-08-23T17:29:46Z

app/src/org/commcare/CommCareApplication.java

@@ -251,6 +253,11 @@ public void onCreate() {
        GraphUtil.setLabelCharacterLimit(getResources().getInteger(R.integer.graph_label_char_limit));

        FirebaseMessagingUtil.verifyToken();
+
+        if(getEncryptionKeyProvider() == null) {


Think we can remove the null check here. As a best practice, child classed should be expected to call super.OnCreate() as the first thing in the override method. They should be able to call setEncryptionKeyProvider after super.OnCreate() and override the defaults.

…de later). Some small code cleanup.

…estApplication.

Auto-reformatted code in several files. Renamed several variables so acronyms use camel-case. Broke some longer lines into multiple.

…doc comments

Dave Viggiano added 7 commits March 2, 2023 10:58

Initial work on ConnectId UI and some intro logic. Working toward POC.

6153242

Got rid of locked state for Connect ID (only logged out or logged in).

466026c

Getting ready for network calls.

Renamed some files for consistency.

06f9936

Initial registration workflow working. Implemented basic photos page and SMS verification.

Changes to initial ConnectID create/recovery workflow.

6d7b527

Basic password manager implementation after ConnectID login.

A few look-and-feel changes

87c6d0f

Merge remote-tracking branch 'origin/master' into dv/connect_id

1bfa868

Disabling ConnectID functionality by default.

d16af33

OrangeAndGreen requested review from shubham1g5 and avazirna April 12, 2023 18:06

OrangeAndGreen self-assigned this Apr 12, 2023

OrangeAndGreen changed the title ~~Dv/connect~~ ConnectID Initial Implementation Apr 12, 2023

Changed min SDK to 23.

a60a863

Implemented local encrypted DB for data related to Connect.

shubham1g5 reviewed Apr 24, 2023

View reviewed changes

app/build.gradle Outdated Show resolved Hide resolved

Dave Viggiano added 6 commits April 27, 2023 10:06

Added activity for getting Connect recovery vs. new account decision.

e2cb6cb

Some cleanup after achieving POC functionality. Using secure storage for password manager functionality.

Fixed recently introduced crash after server error on Connect registr…

f07b4ed

…ation call.

Remembering registration phase to resume after app interruption.

5bd6747

Several UI improvements, rewording.

Icons instead of highlighted text on two pages.

0cf3b66

A couple small bug fixes. Preparing for OIDC calls.

ConnectID V1 development, including several new activities.

52b1bb7

Moved ConnectID activities into a sub-namespace called connect.

Added ConnectID unlock functionality as a developer option.

e5590c6

Showing recovery phone number in UI when sending alt OTP.

OrangeAndGreen added the cross requested label Jun 9, 2023

OrangeAndGreen mentioned this pull request Jun 9, 2023

Added flag to make wrapping username with domain optional (to support basic auth). dimagi/commcare-core#1290

Merged

3 tasks

Dave Viggiano added 2 commits June 9, 2023 14:31

Quick fix: Changed a key received from the server.

23881d8

Dave Viggiano added 4 commits June 14, 2023 15:34

Merge remote-tracking branch 'origin/master' into dv/connect_id

74a21d6

Added two new externalizable classes to list for FormStorageTest (fix…

ab4e140

…ing a broken test).

Added one more externalizable class to FormStorageTest list.

64ca2d2

Dave Viggiano added 3 commits August 21, 2023 09:24

Addressing comments for PR.

525b332

Checking if ConnectID is unlocked before retrieving SSO token. No null check on passphrase when retrieving from global DB.

Tying transformation string to existing key in Keystore (so app can s…

d88d97d

…till use RSA after upgrading to API >=31).

Showing progress dialogs for ConnectID network calls.

de32648

shubham1g5 requested changes Aug 21, 2023

View reviewed changes

Dave Viggiano and others added 4 commits August 22, 2023 13:32

Added some missing strings (from conflict).

3ca59c3

Improved EncryptionUtils documentation, fixed a couple lint warnings, and reformatted code. Abstracted onFinishProcessing function in ConnectIDNetworkHelper.

Merge branch 'master' into dv/connect_id

0661af5

Removed extra API check and suppressed code warning.

bf11aa2

Merge branch 'dv/connect_id' of https://github.com/dimagi/commcare-an…

c4eb7bf

…droid into dv/connect_id

Dave Viggiano added 3 commits August 23, 2023 10:38

Reverted KeyAndTransform from record back to simple helper class (cau…

f8724f0

…sed runtime crash).

Merge branch 'master' of https://github.com/dimagi/commcare-android i…

be096bb

…nto dv/connect_id

Refactored encryption key code into EncryptionKeyProvider class and e…

28c4610

…xposed via CommCareApplication. Created MockEncryptionKeyProvider to allow encryption without Keystore in tests.

shubham1g5 reviewed Aug 23, 2023

View reviewed changes

Dave Viggiano added 8 commits August 23, 2023 13:46

Assigning default encryptionKeyProvider immediately (child can overri…

b3aa48e

…de later). Some small code cleanup.

Creating MockEncryptionKeyProvider after super.onCreate for CommCareT…

5f53442

…estApplication.

Addressing lint warnings.

4bb727e

Auto-reformatted code in several files. Renamed several variables so acronyms use camel-case. Broke some longer lines into multiple.

Addressing more lint warnings, mostly code formatting and adding Java…

ee16434

…doc comments

Added javadoc descriptions

f548a4a

Broke some long lines into multiple

b5b60e7

Addressing remaining lint warnings in ConnectIDManager.

d6719e3

Cleaning up more lint warnings.

8855e6b

shubham1g5 added this to the 2.55 milestone Aug 24, 2023

Addressing more lint warnings.

6409159

OrangeAndGreen changed the base branch from master to feature/connect August 24, 2023 15:39

shubham1g5 approved these changes Aug 24, 2023

View reviewed changes

Dave Viggiano added 2 commits August 24, 2023 12:19

Renamed all ConnectID* classes to ConnectId*

b8d8997

Fixed more lint warnings.

98c0a6f

OrangeAndGreen merged commit cdea42d into feature/connect Aug 24, 2023

OrangeAndGreen deleted the dv/connect_id branch August 24, 2023 17:17

OrangeAndGreen restored the dv/connect_id branch May 23, 2024 18:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ConnectID Initial Implementation #2660

ConnectID Initial Implementation #2660

OrangeAndGreen commented Apr 12, 2023 •

edited by shubham1g5

shubham1g5 commented Apr 12, 2023

OrangeAndGreen commented Jun 9, 2023

OrangeAndGreen commented Jun 13, 2023

shubham1g5 left a comment

shubham1g5 Aug 21, 2023

OrangeAndGreen Aug 22, 2023

shubham1g5 Aug 21, 2023

shubham1g5 Aug 21, 2023

OrangeAndGreen Aug 22, 2023

shubham1g5 Aug 22, 2023

OrangeAndGreen Aug 23, 2023

shubham1g5 Aug 21, 2023

OrangeAndGreen Aug 22, 2023

shubham1g5 commented Aug 23, 2023

shubham1g5 Aug 23, 2023

OrangeAndGreen Aug 23, 2023

		@@ -69,18 +69,29 @@ private static KeyStore getKeystore() throws KeyStoreException, CertificateExcep
		return keystoreSingleton;
		}

ConnectID Initial Implementation #2660

ConnectID Initial Implementation #2660

Conversation

OrangeAndGreen commented Apr 12, 2023 • edited by shubham1g5

Summary

Feature Flag

Product Description

Safety Assurance

Automated test coverage

Safety story

shubham1g5 commented Apr 12, 2023

OrangeAndGreen commented Jun 9, 2023

OrangeAndGreen commented Jun 13, 2023

shubham1g5 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shubham1g5 commented Aug 23, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

OrangeAndGreen commented Apr 12, 2023 •

edited by shubham1g5