Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use Apricot for authentication/identity #1772

Merged
merged 32 commits into from
Apr 17, 2024
Merged

Use Apricot for authentication/identity #1772

merged 32 commits into from
Apr 17, 2024

Conversation

jemrobinson
Copy link
Member

@jemrobinson jemrobinson commented Apr 8, 2024 •
edited
Loading

✅ Checklist

  • You have given your pull request a meaningful title (e.g. Enable foobar integration rather than 515 foobar).
  • You are targeting the appropriate branch. If you're not certain which one this is, it should be develop.
  • Your branch is up-to-date with the target branch (it probably was when you started, but it may have changed since then).
  • You have marked this pull request as a draft and added '[WIP]' to the title if needed (if you're not yet ready to merge).
  • You have formatted your code using appropriate automated tools (for example ./tests/AutoFormat_Powershell.ps1 -TargetPath <path to file or directory> for Powershell).

⤴️ Summary

  • Add an Apricot server to the SRE
  • Update SRE components to use Apricot for authentication/identity

🌂 Related issues

Depends on #1778
Second part of #1570
Closes #1645

🔬 Tests

Tested on a fresh SRE deployment

@jemrobinson
✨ Initial skeleton of SRE identity component
de17e60
@jemrobinson
✨ Add identity subnet and container group
d4b4b6f
@jemrobinson
✨ Add an AzureADApplication to the identity component
6d3a6d1
@jemrobinson
✨ Add a firewall rule for SRE identity servers
f69cb84
@jemrobinson
🔧 Add network rules to allow workspaces to connect to SRE identity se…
a2a790f 
…rver
@jemrobinson
♻️ Simplify 'security_group_name' to 'group_name'
0d4421e
@jemrobinson
🔧 Add network rules to allow Guacamole desktop to connect to SRE iden…
5525095 
…tity server
@jemrobinson
🚚 Move ordering of SRE component construction
4c189b2
@jemrobinson
⬆️ Update to apricot 0.0.5 which allows user/group ID caching
d217036
@jemrobinson
✨ Set LDAP lookup variables and filters appropriate for Apricot rathe…
29ca579 
…r than ActiveDirectory
@jemrobinson
⬆️ Update to guacamole-user-sync 0.4.0 which allows anonymous bind an…
247edf5 
…d specification of user/group lookup attributes and LDAP ports.
@jemrobinson
⬆️ Update workspace image to use SRE identity server instead of SHM
06fd05d
@jemrobinson
⚰️ Drop Domain SID extraction as this is not needed with Apricot
c80a4cf
@jemrobinson
♻️ Update Gitea server to use Apricot for identity
052a397
@jemrobinson jemrobinson changed the base branch from develop to python-migration April 8, 2024 10:04
@jemrobinson jemrobinson deleted the branch alan-turing-institute:develop April 8, 2024 13:20
@jemrobinson jemrobinson closed this Apr 8, 2024
@jemrobinson jemrobinson reopened this Apr 8, 2024
@jemrobinson jemrobinson changed the base branch from python-migration to develop April 8, 2024 13:24
@jemrobinson jemrobinson force-pushed the 1570-replace-domain-controller-with-apricot branch from edc55d5 to dbe1aa2 Compare April 8, 2024 13:51
@jemrobinson jemrobinson force-pushed the 1570-replace-domain-controller-with-apricot branch from e44cde8 to 9fd8f69 Compare April 10, 2024 12:54
@jemrobinson jemrobinson mentioned this pull request Apr 10, 2024
Closed
8 tasks
@jemrobinson jemrobinson changed the title [WIP] Replace domain controller with Apricot [WIP] Use Apricot for authentication/identity Apr 10, 2024
@jemrobinson jemrobinson force-pushed the 1570-replace-domain-controller-with-apricot branch 2 times, most recently from 974825c to 974378c Compare April 10, 2024 14:03
@jemrobinson jemrobinson mentioned this pull request Apr 11, 2024
Merged
5 tasks
@jemrobinson jemrobinson force-pushed the 1570-replace-domain-controller-with-apricot branch from 974378c to 8706366 Compare April 15, 2024 10:10
@jemrobinson jemrobinson changed the title [WIP] Use Apricot for authentication/identity Use Apricot for authentication/identity Apr 15, 2024
@jemrobinson jemrobinson requested a review from a team April 15, 2024 10:11
@jemrobinson jemrobinson marked this pull request as ready for review April 15, 2024 10:11
@jemrobinson jemrobinson requested a review from a team as a code owner April 15, 2024 10:11
@jemrobinson jemrobinson force-pushed the 1570-replace-domain-controller-with-apricot branch 2 times, most recently from ca29007 to 5bf4bf2 Compare April 15, 2024 12:57
@jemrobinson jemrobinson mentioned this pull request Apr 15, 2024
Merged
4 tasks
JimMadge
JimMadge requested changes Apr 16, 2024
View reviewed changes
Copy link
Member

@JimMadge JimMadge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good. Makes a lot more sense to me than DCs.

I've put a few formatting suggestions and questions. We might want to open issues for future improvements but I don't see much reason to hold this up.

data_safe_haven/external/api/graph_api.py Outdated Show resolved Hide resolved
data_safe_haven/external/api/graph_api.py Show resolved Hide resolved
data_safe_haven/infrastructure/common/enums.py Show resolved Hide resolved
data_safe_haven/infrastructure/stacks/declarative_sre.py Outdated Show resolved Hide resolved
data_safe_haven/infrastructure/stacks/shm/domain_controllers.py Outdated Show resolved Hide resolved
data_safe_haven/infrastructure/stacks/shm/firewall.py Show resolved Hide resolved
data_safe_haven/infrastructure/stacks/shm/firewall.py Outdated Show resolved Hide resolved
data_safe_haven/infrastructure/stacks/sre/networking.py Outdated Show resolved Hide resolved
data_safe_haven/infrastructure/stacks/sre/remote_desktop.py Show resolved Hide resolved
This was referenced Apr 17, 2024
Open
Open
@JimMadge
Copy link
Member

I've removed the ldap-filter dependency as I'm not sure the Pythonic object structure is much clearer and the library seems to be inactive.

@JimMadge JimMadge merged commit eb1a73b into alan-turing-institute:develop Apr 17, 2024
10 checks passed
@jemrobinson jemrobinson deleted the 1570-replace-domain-controller-with-apricot branch April 19, 2024 11:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@JimMadge JimMadge JimMadge approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Pulumi: replace LDAP user secret
2 participants
@jemrobinson @JimMadge