Restrict allowedIssuers when verifying assertion about tokenserver

[rfk]

Are we doing it now?

We are not. There's a config setting to do it but it's not set to anything in our deployments. I'd like to see the following rules:

• for production:
  • trusted_issuers = api.accounts.firefox.com
  • allowed_issuers = api.accounts.firefox.com
• for stage/dev/etc:
  • trusted_issuers = api.accounts.firefox.com api-accounts.$ENV.mozaws.net
  • allowed_issuers = api.accounts.firefox.com api-accounts.$ENV.mozaws.net mockmyid.com

(Note two different settings here: "trusted issuers" are the ones that are allowed to assert for arbitrary identities; "allowed issuers" is a whitelist of issuers we accept from, even if it's a primary-backed assertion)

Allowing mockmyid for non-prod environments makes testing easier because we don't have to interact with the upstream FxA server at all. Allowing dev fxa servers with dev tokenserver seems useful for full-stack testing.

@ckarlof thoughts? I'll attempt a puppet-config PR with the necessary changes.

[rfk]

The necessary changes have been made in puppet config and will go out with the next deployment; @jbonacci to work with me to verify that untrusted issuers are not accepted once it rolls out to stage.

[ckarlof]

Which deployment will work with our dev prod-clone? i.e.: https://api-accounts-dev.stage.mozaws.net

[rfk]

A currently-non-existent "dev" deployment of TS+sync would do so. Should we authorize this issuer for the TS stage environment as well?

[ckarlof]

Should we authorize this issuer for the TS stage environment as well?

Sounds good. We use that dev environment to test FxA Sync against candidate releases from time to time, so it would be nice if that didn't break.

[ckarlof]

Is allowed_issuers exercised in a test anywhere? I couldn't find one. Let us please avoid a goto fail.

[ckarlof]

Title change: 'Restrict trustedIssuers when verifying assertion" > "Restrict allowedIssuers when verifying assertion"

[rfk]

Tests in https://bugzilla.mozilla.org/show_bug.cgi?id=981985

[ckarlof]

A currently-non-existent "dev" deployment of TS+sync would do so. Should we authorize this issuer for the TS stage environment as well?

The time may have come: mozilla/fxa-content-server#1499

We're spinning up fxa-dev instances (running under *.dev.lcip.org) to test with Sync. What's the appropriate token server/sync back end to integrate with?