Realms #3854

seanmonstar · 2013-09-04T03:08:12Z

This adds realm support to Persona, specifically using the watch() api.

Realms allow a group of sites to state they are connected as part of a group, and if a user logs into 1 site of the group, or realm, the user should be logged into all the sites in realm.

This can be done by passing an extra parameter to watch():

navigator.id.watch({
  realm: 'http://realm.123done.org'
});

The second part of the puzzle is that the watched realm must publish a well-known file describing everyone that is part of the realm.

GET http://realm.123done.org/.well-known/browserid-realm
{
  realm: ['http://foo.123done.org', 'http://bar.123done.org']
}

If the site's origin is found in the list of the realms found at the well-known file, then Persona will believe it is part of the realm. If a user had logged in to foo.123done.org, and then visited bar.123done.org, and that site also watches the same realm, the user will be automatically logged in upon page load.

fixes #2555

Blockers to merging

B2G testing with @jedp
QA? perhaps QA is involved once merged to dev?
Plan for automated testing, how can we avoid regression? Do we need a new (set) of RPs so we can confirm we don't regress on this feature?
security testing with Yvan
legal bug with @lloyd @seanmonstar and Jishnu
identity-ops deploying new proxy mozilla/identity-ops@e6e2931

This adds realm support to Persona, specifically using the watch() api. Realms allow a group of sites to state they are connected as part of a group, and if a user logs into 1 site of the group, or realm, the user should be logged into all the sites in realm. This can be done by passing an extra parameter to watch(): navigator.id.watch({ realm: 'http://realm.123done.org' }); The second part of the puzzle is that the watched realm must publish a well-known file describing everyone that is part of the realm. GET http://realm.123done.org/.well-known/browserid-realm { realm: ['http://foo.123done.org', 'http://bar.123done.org'] } If the site's origin is found in the list of the realms found at the well-known file, then Persona will believe it is part of the realm. If a user had logged in to foo.123done.org, and then visited bar.123done.org, and that site also watches the same realm, the user will be automatically logged in upon page load.

seanmonstar · 2013-09-04T03:53:56Z

bin/proxy

 const allowed_kpi = /^https:\/\/[a-zA-Z0-9\.\-_]+\/wsapi\/interaction_data(\?.*)?$/;

 var server = http.createServer(function (req, res) {
  var url = req.url;
-  if (!allowed.test(url) && !allowed_kpi.test(url) ) {
+  if (!allowed.test(url) && !allowed_realm.test(url) && !allowed_kpi.test(url) ) {


will this also require changes to our production proxy?

Possibly, @gene1wood or @jrgm?

@shane-tomlinson Will this change result in persona initiating outbound connections out to the internet to new destinations (destinations other than sites' well-known/.browserid files and identity bridge endpoints [yahoo, gmail, etc])?

@gene1wood - indeed, the new outbound request will search for realm files at <rp_location>/.well-known/browserid-realm

Proxy server support added here mozilla/identity-ops@e6e2931

When QA wants to see this code in stage they'll need to request that new proxy server AMIs be built with this new code in the process. (cc @jrgm)

Excellent, thanks @gene1wood

to use a realm, pass a query parameter Example: localhost:10001/?realm=http://localhost:10001

seanmonstar · 2013-09-09T18:00:12Z

@ozten I can, but I dislike it. hacks away

jrgm · 2013-09-09T18:36:51Z

You can use something like stunnel[1] to get https working with the local environment.
[1] https://www.stunnel.org/

ozten · 2013-09-09T19:29:49Z

Word. I also dislike SHIMMED_PRIMARIES ( I think a config file or something would be nicer), but something like it.

seanmonstar · 2013-09-09T19:48:00Z

Yea, I've just now make a SHIMMED_REALMS dealio, and it works. But I had to remove 2 tests that were specific to http requests (status code and content-type), which is unfortunate.

seanmonstar · 2013-09-09T23:07:51Z

New commit requires that the browserid-realm file be served over HTTPS.

shane-tomlinson · 2013-09-10T14:17:18Z

lib/realm.js

+
+// Support for "shimmed realms" for local development.
+// CSV values:
+//  <realm>|<browserid-realm filepath>,


This took me a while to figure out how to do from bash command line:

SHIMMED_REALMS=127.0.0.1\|example/rp/.well-known/browserid-realm npm start

Can you add a comment about how to make it so? This info should probably go into the front end wiki as well.

shane-tomlinson · 2013-09-10T15:00:37Z

While testing this, I came across a problem: I can't log out!

STR

Set up dev environment to use a shimmed realm of 127.0.0.1
In tab 1, load up http://127.0.0.1:10001/?realm=127.0.0.1
In tab 2, load up http://localhost:10001/?realm=127.0.0.1
Sign in to the RP in tab 1
Sign in to the RP in tab 2
In tab 2, click "logout". Refresh the page. Still logged in... :(

seanmonstar · 2013-09-10T19:06:28Z

@shane-tomlinson ah, I just found out why. The communication_iframe doesn't call user.logout(), instead it has it's own implementation. Can you of a reason why? I can't, so I'll likely just have it call User.logout().

- fixes navigator.id.logout() to logout of realm - tests for storage.realmInfo - code style change for lib/realm - comments - realm no longer can include port - consolidating fixupIssuer and fixupRealm

seanmonstar · 2013-09-11T03:22:10Z

@shane-tomlinson Newest commit tries to address your concerns. Please berate if I forgot any.

jaredhirsch · 2013-09-16T16:13:51Z

@seanmonstar anything I can do to push this thing along?

seanmonstar · 2013-09-16T17:29:58Z

@6a68 blockers are in a checklist at top of this PR.

currently, trying to deploy a couple of 123dones that use realms, so that security and @jedp can test against them

request does tunneling with proxies, and our proxies don't support tunneling. until request provides an option to disable tunnels, we'll have to use our own http code

jedp · 2013-09-21T13:07:48Z

There are some interesting issues with b2g. (What else is new?) I think we're going to need some platform code to make this work.

Basically, the removal of items from localStorage fires events that we can catch on normal web sites, but on b2g, data siloing and the discarding of the persona iframe when RPs are not using it (a we-will-kill-you-if-you-do-not-do-this requirement from platform) conspire to make it impossible for other RPs to hear about the logout unless we write some native code to fire onlogout for every RP with the same realm. If that's the only solution, backwards compatibility with existing FirefoxOS devices is not possible.

I've filed this bug for FirefoxOS: https://bugzilla.mozilla.org/show_bug.cgi?id=919157

@shane-tomlinson maybe we can pow-wow quickly about this for a sanity check? Make sure I've not got this completely wrong?

with multiple tabs open on sites that all belong to a realm, when logging into one, all the others should also be logged in

lloyd · 2013-09-25T13:43:51Z

wild question. If we didn't have to worry about logout events, how much simpler would this code be? In that case, we would simply flip the logged-on bit at login time, and users would logout of each realm independently... right?

callahad · 2013-09-25T17:40:27Z

See my nay-saying re: logout events in #3915 (comment) :)

jaredhirsch · 2013-09-27T21:49:31Z

@seanmonstar I think, as far as automated tests go, having 2-3 long-lived subdomains of 123done is perfectly fine. They're distinct from the perspective of the same-origin policy, and that's the simplest solution I can think of.

I'd check that box and get on with the other 5. Do you need help with writing automated tests?

jaredhirsch · 2013-10-15T19:05:51Z

Closing because upcoming API changes (see #3961) remove realms support. @seanmonstar please reopen if I'm off base.

seanmonstar added 2 commits September 3, 2013 18:11

adding /wsapi/realm_info?realm=foo.com

f6e2b48

seanmonstar reviewed Sep 4, 2013
View reviewed changes

turns realm off by default on rp example

7d81daa

to use a realm, pass a query parameter Example: localhost:10001/?realm=http://localhost:10001

forcing browserid-realm files to be https

a76701f

shane-tomlinson reviewed Sep 10, 2013
View reviewed changes

logout fix

a38a69f

- fixes navigator.id.logout() to logout of realm - tests for storage.realmInfo - code style change for lib/realm - comments - realm no longer can include port - consolidating fixupIssuer and fixupRealm

seanmonstar added 2 commits September 19, 2013 12:24

dont use request

527c4f5

request does tunneling with proxies, and our proxies don't support tunneling. until request provides an option to disable tunnels, we'll have to use our own http code

be sure to JSON.parse if options.json

28152c7

watch realm state

bc5c8a9

with multiple tabs open on sites that all belong to a realm, when logging into one, all the others should also be logged in

jedp mentioned this pull request Sep 24, 2013

Add realms logout support to internal_api for native #3915

Closed

jaredhirsch closed this Oct 15, 2013

jrgm pushed a commit to jrgm/identity-ops that referenced this pull request Dec 5, 2013

Adding support for browserid-realm mozilla/persona#3854

e6e2931

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Realms #3854

Realms #3854

seanmonstar commented Sep 4, 2013

seanmonstar Sep 4, 2013

shane-tomlinson Sep 5, 2013

gene1wood Sep 5, 2013

shane-tomlinson Sep 5, 2013

gene1wood Sep 5, 2013

shane-tomlinson Sep 5, 2013

seanmonstar commented Sep 9, 2013

jrgm commented Sep 9, 2013

ozten commented Sep 9, 2013

seanmonstar commented Sep 9, 2013

seanmonstar commented Sep 9, 2013

shane-tomlinson Sep 10, 2013

shane-tomlinson commented Sep 10, 2013

seanmonstar commented Sep 10, 2013

seanmonstar commented Sep 11, 2013

jaredhirsch commented Sep 16, 2013

seanmonstar commented Sep 16, 2013

jedp commented Sep 21, 2013

lloyd commented Sep 25, 2013

callahad commented Sep 25, 2013

jaredhirsch commented Sep 27, 2013

jaredhirsch commented Oct 15, 2013

Realms #3854

Realms #3854

Conversation

seanmonstar commented Sep 4, 2013

Blockers to merging

seanmonstar Sep 4, 2013

Choose a reason for hiding this comment

shane-tomlinson Sep 5, 2013

Choose a reason for hiding this comment

gene1wood Sep 5, 2013

Choose a reason for hiding this comment

shane-tomlinson Sep 5, 2013

Choose a reason for hiding this comment

gene1wood Sep 5, 2013

Choose a reason for hiding this comment

shane-tomlinson Sep 5, 2013

Choose a reason for hiding this comment

seanmonstar commented Sep 9, 2013

jrgm commented Sep 9, 2013

ozten commented Sep 9, 2013

seanmonstar commented Sep 9, 2013

seanmonstar commented Sep 9, 2013

shane-tomlinson Sep 10, 2013

Choose a reason for hiding this comment

shane-tomlinson commented Sep 10, 2013

seanmonstar commented Sep 10, 2013

seanmonstar commented Sep 11, 2013

jaredhirsch commented Sep 16, 2013

seanmonstar commented Sep 16, 2013

jedp commented Sep 21, 2013

lloyd commented Sep 25, 2013

callahad commented Sep 25, 2013

jaredhirsch commented Sep 27, 2013

jaredhirsch commented Oct 15, 2013