Add support for validation of Identity Provider (example: Cognito) issued auth tokens
Remote validation of IdP issued tokens:
-
Validation of remote tokens should be part of verifying API identity for Orthanc and Data Services -
They should be included in the workflow of the visionaire.auth.forms.base.SonadorServiceAuthorizationBaseForm
the last option. -
It should be possible to remote IdP validation on/off in the administrative panel. -
When a remote token is verified by a form, it should execute the same workflow as the OIDC authentication views: verify token -> retrieve user instance (create Django user if needed) -> synchronize groups -
A validation rule needs to be added to the form instance which persists authentication servers to ensure that the provider has a validate_token
method defined before allowing for remote token validation to be enabled. -
A signal should be added so that it if a provider loses the validate_token
method (where it previously had one defined), then all the associated authentication servers have remote IdP validation disabled.
Notes:
- Moving "cache remote IdP tokens" to a separate issue for right now. Line item previously read, "Cache the token in a session to prevent un-necessary round-trips (the cache period should be the same as the expiry time of the token). When caching token credentials in a session, the token value should be hashed using one-way password hash so that Sonador isn't storing sensitive values." Refer to #63 (closed).
Edited by Rob Oakes