Authentication and authorization

This page is mainly intended for team members who need to understand how our system is designed to work, although it could also be of interest to anyone reusing the codebase for a new project.

Authentication

We use two authentication methods:

1. CMS Identity Management (IDM), which we tend to call "EUA" informally. This is a single-sign-on system built on Okta, and it includes multi-factor authentication.
2. Django user authentication, which is a simple username-and-password system.

Users in our production environment use CMS IDM. Team members use Django user authentication for development purposes.

Dev info:

• Working with CMS Single-Sign-On in our readme
• Team developer guide (requires login)

Separate from user authentication and authorization, our dev and val environment URLs (including experimental branches) require basic HTTP auth as a simple gate to prevent use of non-prod versions of the site outside of the development team. We have environment variables HTTP_AUTH_PASSWORD and HTTP_AUTH_USER to configure those credentials.

How to log in

1. CMS IDM: /login/ (this is configured by the LOGIN_URL parameter)
2. Django authentication: /admin/

Authorization

We have four roles: reader, editor, manager, admin.

Django includes a "groups" feature for managing permissions. We have one group for each role.

CMS IDM is connected to a "job code" system that manages authorization: individual users request a specific job code appropriate to their role for each CMS application they use. We have four job codes per IDM environment, one for each role. Each job code is connected to a Django group. We have details about job codes on the CMS side (requires login) and about roles and permissions on the Django side.

The expected process for an IDM user is:

1. Have an IDM account
2. Request an eRegs job code within the CMS system
3. Job code is approved
4. Log into eRegs
5. eRegs automatically creates the user with the appropriate group according to their job code

For Django user authentication for team members, we create users, manage permissions, and deactivate users by hand.

Environments

See Team developer guide (requires login) for all URLs registered in Okta.

Configuration for each environment is controlled by the DJANGO_SETTINGS_MODULE environment variable. Local is cmcs_regulations.settings.local, and everything else is cmcs_regulations.settings.deploy.

Methods supported:

• Dev local
  • Django auth
• Experimental branches
  • Django auth
  • One branch is configured to enable Test IDM
• Dev environment
  • Django auth
  • Test IDM
• Val environment
  • Django auth
  • Val (Impl) IDM
• Prod environment
  • Django auth
  • Prod IDM