ocadotechnology / codeforlife-sso Goto Github PK

We are currently using the packages:

1. django-two-factor-auth to integrate two factor auth into django's templates.
2. django-otp for OTP generation and validation. django-two-factor-auth is built on top of this.

Replace these packages with:

1. pyotp to generate and validate OTP codes
2. qrcode to generate QR codes.

WARNING: we should carefully read pyotp's security checklist and ensure we're following best practices.

Once we generate an OTP code with pyotp, we can follow the example on pyotp's documentation to generate qrcodes using the qrcode package. For optimal resolution, we should generate the qrcodes as SVG's, not PNG. For this we'll need to install the pillow extension with the qrcode packages: pip install "qrcode[pil]". The ideal image_factory setting for us seems to be qrcode.image.svg.SvgPathFillImage, which fills the background of the SVG with white. Then, we can return the SVG as a string or binary to the front end.

• generate and validate otp per user
• generate and return svg qrcode
• create backup tokens

https://github.com/ocadotechnology/codeforlife-sso
Create our new SSO service. This service will authenticate users. It should expose the following endpoints:

1. POST /api/user/{user_id}/session/
   This is the login endpoint. It will create a user session given the correct username/email and password.

• Django's login view must be used for this endpoint.
• The session cookies needs to have the attribute domain=codeforlife.education set (see)
• Only requests coming from whitelisted origins should be accepted. This should be an environment variable.
• Save sessions in django_sessions db table

2. DELETE /api/user/{user_id}/session/
   This is the logout endpoint. It will delete the user's session.

• Django's logout view must be used for this endpoint.
• It need's the user's session cookie to run.

3. GET /api/cron/user/unverified/clear_sessions/
   This is a endpoint/cronjob the currently lives in portal-react.

• This needs to be relocated to this service
• update the cron schedule in the workspace repo.

Please create a new repo for this service similar to the structure of the portal-react repo. It should have both a backend and frontend directory. At a later point, the frontend folder will contain the login pages. For this task, just implement the backend.

NOTE: you will probably need to install common and copy the migrations from portal-react to get database in the correct state.