Feature/auth quickstart #48

joshmarsh · 2019-12-05T23:44:31Z

Proposed changes

Organized the quickstart into sections
Added instructions for creating users/admins and authenticating using cognito

https://github.com/Optum/dce-cli/blob/feature/auth-quickstart/docs/quickstart.md

Types of changes

Bugfix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Refactor (changes to code, which do not change application behavior)

Checklist

I have filled out this PR template
I have read the CONTRIBUTING doc
I have added automated tests that prove my fix is effective or that my feature works
I have added necessary documentation (README.md, inline comments, etc.)
I have updated the CHANGELOG.md under a ## next release, with a short summary of my changes

Relevant Links

Backend PR for this functionality: Optum/dce#149
Issue: #33

Further comments

eschwartz · 2019-12-09T21:49:07Z

docs/quickstart.md

+
+## Deploying DCE
+
+1. [Download and install the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html)


I would tweak this a bit. The AWS CLI isn't actually a dependency of the DCE CLI, right? We're just borrowing the ~/.aws/credentials file to load creds.

But we can also load creds from env vars.

Note quite sure the best wording for this. The AWS docs on this are a little messy.

Checkout how Terraform talks through it: https://www.terraform.io/docs/providers/aws/index.html#shared-credentials-file (though that's a lot more verbose than we need)

Or see the AWS CLI order of precedence:
https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#config-settings-and-precedence

Note that we also have another way to load AWS creds, from the api.token config in dce.yml, which is populated by the dce auth command.

I'm thinking maybe we just need a separate section or page to cover AWS creds.

Unfortunately we are using the aws cli as a dependency here.

I think we discussed using the aws cli to manage creds in a way that was platform agnostic a while ago. I've since discovered build constraints and believe we should use those instead. This should be done as a seperate PR: #49

Thanks for the helpful links. I'll go ahead and update this section.

eschwartz · 2019-12-09T21:50:28Z

docs/quickstart.md

+
+## Authenticating with the DCE System
+
+DCE uses AWS Cognito to manager authentication and authorization.


DCE CLI uses AWS Cognito to ~~manager~~ manage authentication and authorization.

I'm not sure if I agree with this. Users that want to hit the API directly don't currently have an alternative auth mechanism than to use Cognito.

While the current experience of logging into a web page isn't geared towards API users, I wouldn't call Cognito a CLI only feature unless we have plans to introduce an alternative auth mechanism for non-CLI users.

eschwartz · 2019-12-09T21:51:50Z

docs/quickstart.md

+    region: us-east-1
+    ```
+
+## Authenticating with the DCE System


This is awesome. Thanks for putting this together @joshmarsh.

I'm going to try running through all this, and let you know how it goes

eschwartz · 2019-12-09T21:54:00Z

docs/quickstart.md

+
+DCE uses AWS Cognito to manager authentication and authorization.
+
+1. Open the AWS Console in your DCE Master Account and Navigate to AWS Cognito by typing `Cognito` in the search bar


Might be worth a little intro here, explaining what we're doing
(ie. that we're manually setting up a user pool, though you can also federate with third party IDPs)

Also maybe a note like:

We'll walk through setting this up in the AWS web console, but note that all of these operations can be automated using the AWS Cognito CLI or SDKs

eschwartz · 2019-12-09T22:03:30Z

docs/quickstart.md

-➜  ~ dce accounts add --account-id 555555555555 --admin-role-arn arn:aws:iam::555555555555:role/DCEMasterAccess
-```
+    ```
+    ➜  ~ dce accounts add --account-id 555555555555 --admin-role-arn arn:aws:iam::555555555555:role/DCEMasterAccess


I would cut these little ➜ ~ prompts. They're kind of confusing.

eschwartz · 2019-12-09T22:21:18Z

docs/quickstart.md

+    region: us-east-1
+    ```
+
+## Authenticating with the DCE System


Probably worth pointing out here that Cognito is an option for authenticating against DCE.
You can also use straight up AWS creds (shared creds file, env vars, ec2 metadata, etc), and DCE will treat you as an admin user.

Just thinking that in my mind "Quick Start" is how some dev is setting this up on their own AWS account, to test it out. They don't really need to do anything with Cognito in that case.

Cognito auth is a more advanced use case, where you're actually federating in with your enterprise's IDP.

I don’t disagree, but I do like having the entire “happy path” documented in detail like this.

What do you think about this merging with the QuickStart in the main repo and becoming our primary “how to” doc? Steps with multiple variations could link to separate documents (e.g. the cognito stuff).

As per our offline conversation: Optum/dce#159

eschwartz · 2019-12-10T16:25:27Z

docs/quickstart.md

+
+    ![Create group](./creategroup.png)
+
+1. Users in this group will be granted admin access to DCE. The group name must contain the term `Admin`. Choose a name and click on the `Create group` button.


must contain the term Admin

@joshmarsh what's the story on this? Is this a mechanism of Cognito, or something we setup?

It just feels a little hacky

This was set up a while ago after we discussed using Cognito User Pool Groups and IdP attributes as the two mechanisms by which we would assign admin/non-admin IAM roles to users.

I'm pretty sure it was intended as a "good enough" solution while we focused on getting auth working overall. We should definitely iterate on it.

eschwartz · 2019-12-10T16:36:43Z

docs/quickstart.md

+
+    ```
+    dce auth
+    ✔ Enter API Token: : █ 


@joshmarsh what's going on with pasting into the terminal? Is it doing this for you, too?

Open issue: #43

eschwartz · 2019-12-10T17:57:43Z

docs/quickstart.md


-8. Use the `dce accounts add` command to add your child account to the "DCE Accounts Pool"
+1. Use the `dce accounts add` command to add your child account to the "DCE Accounts Pool". WARNING: This will delete any resources in the account.


Might want to pull this WARNING down to a new line, and make it bold

eschwartz · 2019-12-10T18:04:31Z

docs/quickstart.md

+   ]
+    ```
+
+1. Notice that [we created a lease for a different user](https://github.com/Optum/dce/issues/137) than the one we are currently authenticated with (i.e. `jdoe99` != `quickstartuser`). If we try to login to this leased account, we will receive a permissions error since it is registered under a different user.


we created a lease for a different user

this is actually a bug in our system, that a user can create a lease for someone else.
I would avoid highlighting this bug in our docs.

eschwartz · 2019-12-12T18:32:47Z

docs/quickstart.md


-```
-# View your leased account credentials
+1. If we try to login to this leased account, we will receive a permissions error since it is registered under a different user (i.e. `jdoe99` != `quickstartuser`).


@joshmarsh I don't think we should be creating a lease for a different user at all. That's a bug in our system that you can do that, right?

eschwartz · 2019-12-12T18:33:01Z

docs/quickstart.md

-1. Use the `dce accounts add` command to add your child account to the "DCE Accounts Pool". WARNING: This will delete any resources in the account.
+1. Use the `dce accounts add` command to add your child account to the "DCE Accounts Pool".
+
+    *WARNING: This will delete any resources in the account.*


eschwartz · 2019-12-12T18:33:27Z

README.md

+| -----------                             | ----------- | -----------                                               | -----------                                                       |
+| Deployment (`dce system deploy`)        | Available   | [Unavailable](https://github.com/Optum/dce-cli/issues/21) |                                                                   |
+| CLI Initialization (`dce init`)         | Available   | Available                                                 |                                                                   |
+| Authentication (`dce auth`)             | Available   | Available                                                 | [Unavailable on Firefox](https://github.com/Optum/dce/issues/166) |


eschwartz · 2019-12-12T18:50:23Z

docs/quickstart.md

-    }
-    ```
-
+    dce leases create --budget-amount 100.0 --budget-currency USD --email [email protected] --principal-id quickstartuser


eschwartz

👍

joshmarsh added 7 commits December 4, 2019 11:06

Updated command reference docs

32bef45

Added auth section to quickstart

bed091e

WIP: Updating login instructions

1b1594d

Updated lease login quickstart

206bb90

Minor quickstart edits

dd64d2d

Updated quickstart for sign out button

6dc7803

Added image alt text

3abc881

joshmarsh requested a review from kddejong December 9, 2019 15:18

kddejong approved these changes Dec 9, 2019

View reviewed changes

joshmarsh requested review from AmudaPalani, eschwartz, marinatedpork and nathanagood December 9, 2019 15:48

eschwartz reviewed Dec 9, 2019

View reviewed changes

eschwartz reviewed Dec 10, 2019

View reviewed changes

Updated quickstart

f358dd5

eschwartz reviewed Dec 10, 2019

View reviewed changes

joshmarsh added 3 commits December 10, 2019 12:49

Removed issue link

c6d9a62

Bolded warning

9b59f6f

Discussed alternative to cognito

7a2cc6c

joshmarsh changed the title ~~Feature/auth quickstart~~ [Do Not Merge] Feature/auth quickstart Dec 11, 2019

Added note about auth for firefox

1dfcf7a

joshmarsh changed the title ~~[Do Not Merge] Feature/auth quickstart~~ Feature/auth quickstart Dec 12, 2019

eschwartz reviewed Dec 12, 2019

View reviewed changes

Removed step

69d26ab

eschwartz reviewed Dec 12, 2019

View reviewed changes

eschwartz approved these changes Dec 12, 2019

View reviewed changes

joshmarsh merged commit c40c026 into master Dec 12, 2019

joshmarsh deleted the feature/auth-quickstart branch December 12, 2019 21:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/auth quickstart #48

Feature/auth quickstart #48

joshmarsh commented Dec 5, 2019 •

edited by eschwartz

Loading

eschwartz Dec 9, 2019

joshmarsh Dec 9, 2019 •

edited

Loading

eschwartz Dec 9, 2019

joshmarsh Dec 10, 2019 •

edited

Loading

eschwartz Dec 9, 2019

eschwartz Dec 9, 2019

eschwartz Dec 9, 2019 •

edited

Loading

eschwartz Dec 9, 2019

eschwartz Dec 9, 2019

joshmarsh Dec 9, 2019 •

edited

Loading

joshmarsh Dec 10, 2019

eschwartz Dec 10, 2019

joshmarsh Dec 10, 2019 •

edited

Loading

eschwartz Dec 10, 2019

joshmarsh Dec 10, 2019

eschwartz Dec 10, 2019

eschwartz Dec 10, 2019

eschwartz Dec 12, 2019

eschwartz Dec 12, 2019

eschwartz Dec 12, 2019

eschwartz Dec 12, 2019

eschwartz left a comment


		## Deploying DCE

		1. [Download and install the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html)


		## Authenticating with the DCE System

		DCE uses AWS Cognito to manager authentication and authorization.


		DCE uses AWS Cognito to manager authentication and authorization.

		1. Open the AWS Console in your DCE Master Account and Navigate to AWS Cognito by typing `Cognito` in the search bar


		![Create group](./creategroup.png)

		1. Users in this group will be granted admin access to DCE. The group name must contain the term `Admin`. Choose a name and click on the `Create group` button.


		8. Use the `dce accounts add` command to add your child account to the "DCE Accounts Pool"
		1. Use the `dce accounts add` command to add your child account to the "DCE Accounts Pool". WARNING: This will delete any resources in the account.

Feature/auth quickstart #48

Feature/auth quickstart #48

Conversation

joshmarsh commented Dec 5, 2019 • edited by eschwartz Loading

Proposed changes

Types of changes

Checklist

Relevant Links

Further comments

Choose a reason for hiding this comment

joshmarsh Dec 9, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joshmarsh Dec 10, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eschwartz Dec 9, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joshmarsh Dec 9, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joshmarsh Dec 10, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eschwartz left a comment

Choose a reason for hiding this comment

joshmarsh commented Dec 5, 2019 •

edited by eschwartz

Loading

joshmarsh Dec 9, 2019 •

edited

Loading

joshmarsh Dec 10, 2019 •

edited

Loading

eschwartz Dec 9, 2019 •

edited

Loading

joshmarsh Dec 9, 2019 •

edited

Loading

joshmarsh Dec 10, 2019 •

edited

Loading