<%=raw t(key=@text, org_name: @org_name) %>
<% 'have to put statement here, as do not have route helper in ViewComponent' if @reason == :fail_to_proof %> - <%= link_to 'Go to DPC Portal', new_user_session_path, class: 'usa-button margin-bottom-3' %> + <%= link_to 'Go to DPC Portal', sign_in_path, class: 'usa-button margin-bottom-3' %> <% end %> diff --git a/dpc-portal/app/components/page/invitations/success_component.html.erb b/dpc-portal/app/components/page/invitations/success_component.html.erb index 46579faf67..a4418797a9 100644 --- a/dpc-portal/app/components/page/invitations/success_component.html.erb +++ b/dpc-portal/app/components/page/invitations/success_component.html.erb @@ -23,5 +23,5 @@ <% end %> <% end %> - <%= link_to 'Go to DPC Portal', new_user_session_path, class: 'usa-button margin-right-0' %> + <%= link_to 'Go to DPC Portal', sign_in_path, class: 'usa-button margin-right-0' %> diff --git a/dpc-portal/app/components/page/session/login_component.html.erb b/dpc-portal/app/components/page/session/login_component.html.erb index 0ca1504a55..7594fe539f 100644 --- a/dpc-portal/app/components/page/session/login_component.html.erb +++ b/dpc-portal/app/components/page/session/login_component.html.erb @@ -10,6 +10,10 @@ <%= button_to @login_path, class: 'usa-button width-full margin-bottom-1', data: { turbo: false } do %> Sign in with <% end %> +Sign in with your DPC Portal CLEAR account
+ <%= button_to @clear_login_path, class: 'usa-button width-full margin-bottom-1', data: { turbo: false } do %> + Sign in with CLEAR + <% end %> <%= render(Core::Navigation::SystemUseAgreementLinkComponent.new) %>diff --git a/dpc-portal/app/components/page/session/login_component.rb b/dpc-portal/app/components/page/session/login_component.rb index 83d2318fbc..8189084368 100644 --- a/dpc-portal/app/components/page/session/login_component.rb +++ b/dpc-portal/app/components/page/session/login_component.rb @@ -4,9 +4,10 @@ module Page module Session # Renders the log in page class LoginComponent < ViewComponent::Base - def initialize(login_path) + def initialize(idme_login_path, clear_login_path) super - @login_path = login_path + @login_path = idme_login_path + @clear_login_path = clear_login_path end end end diff --git a/dpc-portal/app/components/page/utility/error_component.html.erb b/dpc-portal/app/components/page/utility/error_component.html.erb index 13c529404b..94190c36c4 100644 --- a/dpc-portal/app/components/page/utility/error_component.html.erb +++ b/dpc-portal/app/components/page/utility/error_component.html.erb @@ -12,7 +12,7 @@ disabled: @invitation&.renewed?, destination: renew_organization_invitation_path(@invitation.provider_organization, @invitation)) %> <% when :ao_accepted %> - <%= link_to new_user_session_path, class: 'usa-button', data: { turbo: false } do %> + <%= link_to sign_in_path, class: 'usa-button', data: { turbo: false } do %> Sign in with <% end %> <% when :cd_accepted %> @@ -30,8 +30,8 @@ destination: login_dot_gov_logout_path, method: :delete) %> <% when :login_gov_signin_cancel %> - <%= link_to 'Back to portal home', new_user_session_path, class: 'usa-button usa-button--outline', data: { turbo: false }%> + <%= link_to 'Back to portal home', sign_in_path, class: 'usa-button usa-button--outline', data: { turbo: false }%> <% when :login_gov_signin_fail %> - <%= link_to 'Back to portal home', new_user_session_path, class: 'usa-button usa-button--outline', data: { turbo: false }%> + <%= link_to 'Back to portal home', sign_in_path, class: 'usa-button usa-button--outline', data: { turbo: false }%> <% end %> diff --git a/dpc-portal/app/controllers/application_controller.rb b/dpc-portal/app/controllers/application_controller.rb index e47488dc32..c116ef8cdc 100644 --- a/dpc-portal/app/controllers/application_controller.rb +++ b/dpc-portal/app/controllers/application_controller.rb @@ -2,8 +2,10 @@ # Parent class of all controllers class ApplicationController < ActionController::Base - IDP_HOST = ENV.fetch('IDP_HOST') - IDP_CLIENT_ID = "urn:gov:cms:openidconnect.profiles:sp:sso:cms:dpc:#{ENV.fetch('ENV')}".freeze + # IDP_HOST = ENV.fetch('IDP_HOST') + CLEAR_IDP_HOST = ENV.fetch('CLEAR_IDP_HOST') + # IDP_CLIENT_ID = ENV.fetch('IDP_CLIENT_ID') + CLEAR_IDP_CLIENT_ID = ENV.fetch('CLEAR_IDP_CLIENT_ID') before_action :check_session_length before_action :set_current_request_attributes @@ -11,6 +13,26 @@ class ApplicationController < ActionController::Base auto_session_timeout User.timeout_in + def active_url + '/active' + end + + def current_user + @current_user ||= User.where(id: session['user']).first + end + + def authenticate_user! + return if current_user + + flash[:alert] = t('devise.failure.unauthenticated') + session[:user_return_to] = request.path + redirect_to sign_in_path + end + + def sign_in(user) + session['user'] = user.id + end + private def check_user_verification @@ -34,11 +56,12 @@ def tos_accepted def url_for_login_dot_gov_logout state = SecureRandom.hex(16) session['omniauth.state'] = state - URI::HTTPS.build(host: IDP_HOST, - path: '/openid_connect/logout', - query: { client_id: IDP_CLIENT_ID, - post_logout_redirect_uri: "#{root_url}users/auth/logged_out", - state: }.to_query) + URI::HTTPS.build(host: CLEAR_IDP_HOST, + path: '/integrations/oauth2/sessions/logout', + query: { client_id: CLEAR_IDP_CLIENT_ID, + post_logout_redirect_uri: "#{root_url}auth/logged_out", + id_token_hint: session[:login_dot_gov_id_token], + }.to_query) end # rubocop:disable Metrics/AbcSize diff --git a/dpc-portal/app/controllers/invitations_controller.rb b/dpc-portal/app/controllers/invitations_controller.rb index 140b0f3c83..26e832771b 100644 --- a/dpc-portal/app/controllers/invitations_controller.rb +++ b/dpc-portal/app/controllers/invitations_controller.rb @@ -62,7 +62,7 @@ def register return unless create_link session.delete("invitation_status_#{@invitation.id}") - sign_in(:user, @user) + sign_in(@user) Rails.logger.info(['User logged in', { actionContext: LoggingConstants::ActionContext::Registration, actionType: LoggingConstants::ActionType::UserLoggedIn, @@ -78,15 +78,28 @@ def login { actionContext: LoggingConstants::ActionContext::Registration, actionType: LoggingConstants::ActionType::BeginLogin, invitation: @invitation.id }]) - url = URI::HTTPS.build(host: IDP_HOST, - path: '/openid_connect/authorize', - query: { acr_values: 'http://idmanagement.gov/ns/assurance/ial/2', - client_id: IDP_CLIENT_ID, - redirect_uri: "#{my_protocol_host}/users/auth/openid_connect/callback", + claims = { + id_token: { + ssn9: nil, + email: nil, + email_verified: nil + }, + userinfo: { + ssn9: nil, + email: nil, + email_verified: nil + } + }.to_json + url = URI::HTTPS.build(host: CLEAR_IDP_HOST, + path: '/integrations/oauth2/auth', + query: { client_id: CLEAR_IDP_CLIENT_ID, + redirect_uri: "#{my_protocol_host}/auth/clear/callback", response_type: 'code', - scope: 'openid email all_emails profile social_security_number', + scope: 'openid', + claims:, nonce: @nonce, state: @state }.to_query) + puts "redirecting to: #{url}" redirect_to url, allow_other_host: true end @@ -132,6 +145,7 @@ def render_bad_invitation?(user_info) def verify_user_is_ao user_info = UserInfoService.new.user_info(session) + puts "user_info: #{user_info}" result = @invitation.ao_match?(user_info) # raises if does not match session[:user_pac_id] = result.dig(:ao_role, 'pacId') log_waivers(result) @@ -203,7 +217,8 @@ def create_ao_org_link def user user_info = UserInfoService.new.user_info(session) - @user = User.find_or_create_by!(provider: :openid_connect, uid: user_info['sub']) do |user_to_create| + # @user = User.find_or_create_by!(provider: :id_me, uid: user_info['sub']) do |user_to_create| + @user = User.find_or_create_by!(provider: :clear, uid: user_info['sub']) do |user_to_create| assign_user_attributes(user_to_create, user_info) log_create_user end diff --git a/dpc-portal/app/controllers/login_dot_gov_controller.rb b/dpc-portal/app/controllers/login_dot_gov_controller.rb index 3a6c29ac37..9e19cced5f 100644 --- a/dpc-portal/app/controllers/login_dot_gov_controller.rb +++ b/dpc-portal/app/controllers/login_dot_gov_controller.rb @@ -1,15 +1,18 @@ # frozen_string_literal: true # Handles interactions with login.gov -class LoginDotGovController < Devise::OmniauthCallbacksController - skip_before_action :verify_authenticity_token, only: :openid_connect +class LoginDotGovController < ApplicationController + # skip_before_action :verify_authenticity_token, only: :id_me + skip_before_action :verify_authenticity_token, only: :clear - def openid_connect + def id_me auth = request.env['omniauth.auth'] + puts "provider: #{auth.provider}" + puts "uid: #{auth.uid}" user = User.find_by(provider: auth.provider, uid: auth.uid) if user - sign_in(:user, user) + sign_in(user) session[:logged_in_at] = Time.now Rails.logger.info(['User logged in', { actionContext: LoggingConstants::ActionContext::Authentication, @@ -19,6 +22,11 @@ def openid_connect redirect_to path(user, auth) end + def clear + # this will probably fail + id_me + end + def no_account render(Page::Utility::ErrorComponent.new(nil, 'no_account'), status: :forbidden) @@ -48,11 +56,6 @@ def logout redirect_to url_for_login_dot_gov_logout, allow_other_host: true end - # Return from login.gov - def logged_out - redirect_to session.delete(:user_return_to) || new_user_session_path - end - private def handle_invitation_flow_failure(invitation_id) @@ -75,21 +78,35 @@ def maybe_update_user(user, data) def ial_2_actions(user, auth) data = auth.extra.raw_info + Rails.logger.info(['CLEAR auth callback user info', + { provider: auth.provider, + uid: auth.uid, + omniauth_email: auth.info.email, + raw_info_sub: data['sub'], + raw_info_email: data['email'], + raw_info_email_verified: data['email_verified'] }]) - return unless data.ial == 'http://idmanagement.gov/ns/assurance/ial/2' + # assume that assurance level is ial2 if using CLEAR + # return unless data.ial == 'http://idmanagement.gov/ns/assurance/ial/2' maybe_update_user(user, data) session[:login_dot_gov_token] = auth.credentials.token + session[:login_dot_gov_id_token] = auth.credentials.id_token session[:login_dot_gov_token_exp] = auth.credentials.expires_in.seconds.from_now end def path(user, auth) - if user.blank? && auth.extra.raw_info.ial == 'http://idmanagement.gov/ns/assurance/ial/1' + puts "auth extra raw_info response: #{auth.extra.raw_info}" + return_to = session.delete(:user_return_to) + return return_to if return_to&.match?(%r{/organizations/[0-9]+/invitations/[0-9]+}) + + # if user.blank? && auth.extra.raw_info.ial == 'http://idmanagement.gov/ns/assurance/ial/1' + if user.blank? Rails.logger.info(['User logged in without account', { actionContext: LoggingConstants::ActionContext::Authentication, actionType: LoggingConstants::ActionType::UserLoginWithoutAccount }]) return no_account_url end - session.delete(:user_return_to) || organizations_path + return_to || organizations_path end end diff --git a/dpc-portal/app/controllers/organizations_controller.rb b/dpc-portal/app/controllers/organizations_controller.rb index 03cedcf792..fb2d94f477 100644 --- a/dpc-portal/app/controllers/organizations_controller.rb +++ b/dpc-portal/app/controllers/organizations_controller.rb @@ -14,7 +14,7 @@ class OrganizationsController < ApplicationController def index @links = current_user.provider_links - ao_or_cd = @links.any? { |link| link.is_a?(AoOrgLink) } + ao_or_cd = @links.any?(AoOrgLink) render(Page::Organization::OrganizationListComponent.new(ao_or_cd:, links: @links)) end diff --git a/dpc-portal/app/controllers/users/sessions_controller.rb b/dpc-portal/app/controllers/users/sessions_controller.rb index b79ab1c66c..c82b22b26f 100644 --- a/dpc-portal/app/controllers/users/sessions_controller.rb +++ b/dpc-portal/app/controllers/users/sessions_controller.rb @@ -1,16 +1,20 @@ # frozen_string_literal: true module Users - # Adds functionality to devise session controller - class SessionsController < Devise::SessionsController + # Handles session destruction + class SessionsController < ApplicationController auto_session_timeout_actions def destroy Rails.logger.info(['User logged out', { actionContext: LoggingConstants::ActionContext::Authentication, actionType: LoggingConstants::ActionType::UserLoggedOut }]) - sign_out(current_user) + session.delete('user') redirect_to url_for_login_dot_gov_logout, allow_other_host: true end + + def logged_out + redirect_to session.delete(:user_return_to) || sign_in_path + end end end diff --git a/dpc-portal/app/helpers/application_helper.rb b/dpc-portal/app/helpers/application_helper.rb new file mode 100644 index 0000000000..f6166740af --- /dev/null +++ b/dpc-portal/app/helpers/application_helper.rb @@ -0,0 +1,12 @@ +# frozen_string_literal: true + +# Utility methods for views +module ApplicationHelper + def current_user + @current_user + end + + def omniauth_authorize_path(service) + "/auth/#{service}" + end +end diff --git a/dpc-portal/app/jobs/verify_resource_health_job.rb b/dpc-portal/app/jobs/verify_resource_health_job.rb index 47b35a9bfe..71f6d74002 100644 --- a/dpc-portal/app/jobs/verify_resource_health_job.rb +++ b/dpc-portal/app/jobs/verify_resource_health_job.rb @@ -9,7 +9,9 @@ class VerifyResourceHealthJob < ApplicationJob METRIC_NAMESPACE = 'DPC' REGION = 'us-east-1' ENVIRONMENT = ENV.fetch('ENV', 'none') - IDP_HOST = ENV.fetch('IDP_HOST', nil) + # IDP_HOST = ENV.fetch('IDP_HOST', nil) + # will fail, not used + CLEAR_IDP_HOST = ENV.fetch('CLEAR_IDP_HOST', nil) # Runs all healthchecks if no args provided def perform(args = {}) @@ -35,10 +37,10 @@ def dpc_healthcheck end def idp_healthcheck - return log_healthcheck('PortalConnectedToIdp', false) if IDP_HOST.nil? + return log_healthcheck('PortalConnectedToIdp', false) if CLEAR_IDP_HOST.nil? # Login.gov doesn't have a /healthcheck, so we look for a 200 to verify connectivity. - response = Net::HTTP.get_response(URI("https://#{IDP_HOST}")) + response = Net::HTTP.get_response(URI("https://#{CLEAR_IDP_HOST}")) log_healthcheck( 'PortalConnectedToIdp', response.code.to_i.between?(200, 299) diff --git a/dpc-portal/app/models/invitation.rb b/dpc-portal/app/models/invitation.rb index 6e48f76c4a..c38b1223ba 100644 --- a/dpc-portal/app/models/invitation.rb +++ b/dpc-portal/app/models/invitation.rb @@ -4,7 +4,7 @@ class Invitation < ApplicationRecord validates :invited_by, :invited_given_name, :invited_family_name, presence: true, if: :needs_validation? validates :invited_email, :invited_email_confirmation, presence: true, if: :new_record? - validates :invited_email, format: Devise.email_regexp, confirmation: true, if: :new_record? + validates :invited_email, format: URI::MailTo::EMAIL_REGEXP, confirmation: true, if: :new_record? validates :invitation_type, presence: true validate :cannot_cancel_accepted validate :check_if_duplicate, if: :new_record? @@ -74,11 +74,12 @@ def renew end def ao_match?(user_info) - check_missing_user_info(user_info, 'social_security_number') + ssn = user_info['social_security_number'].presence || user_info['ssn9'] + raise UserInfoServiceError, 'missing_info' if ssn.blank? service = AoVerificationService.new result = service.check_eligibility(provider_organization.npi, - user_info['social_security_number'].tr('-', '')) + ssn.tr('-', '')) raise VerificationError, result[:failure_reason] unless result[:success] result diff --git a/dpc-portal/app/models/user.rb b/dpc-portal/app/models/user.rb index 8d1edcc031..ced291c76b 100644 --- a/dpc-portal/app/models/user.rb +++ b/dpc-portal/app/models/user.rb @@ -2,12 +2,6 @@ # Base user class class User < ApplicationRecord - # Include default devise modules. Others available are: - # :confirmable, :lockable, and :trackable - devise :database_authenticatable, :registerable, - :recoverable, :rememberable, :validatable, - :timeoutable, :omniauthable, omniauth_providers: [:openid_connect] - audited only: %i[verification_reason verification_status], on: :update validates :verification_reason, allow_nil: true, allow_blank: true, @@ -21,10 +15,16 @@ class User < ApplicationRecord enum :verification_reason, %i[ao_med_sanction_waived ao_med_sanctions] enum :verification_status, %i[approved rejected] - before_validation(on: :create) do - # Assign random, acceptable password to keep Devise happy. - # User should log in only through IdP - self.password = Devise.friendly_token[0, 20] unless password.present? + def self.remember_for + 12.hours + end + + def self.timeout_in + 30.minutes + end + + def timeout_in + self.class.timeout_in end def provider_links diff --git a/dpc-portal/app/services/user_info_service.rb b/dpc-portal/app/services/user_info_service.rb index 1758f51433..0f650d2cb3 100644 --- a/dpc-portal/app/services/user_info_service.rb +++ b/dpc-portal/app/services/user_info_service.rb @@ -2,7 +2,22 @@ # A service that verifies generates an ao invitation class UserInfoService - USER_INFO_URI = URI("https://#{ENV.fetch('IDP_HOST')}/api/openid_connect/userinfo") + USER_INFO_URI = URI("https://#{ENV.fetch('CLEAR_IDP_HOST')}/integrations/userinfo") + USER_INFO_CLAIMS = { + id_token: { + ssn9: nil, + email: nil, + email_verified: nil + }, + userinfo: { + ssn9: nil, + email: nil, + email_verified: nil, + given_name: nil, + family_name: nil + } + }.to_json + USER_INFO_CLAIMS_URI = URI("#{USER_INFO_URI}?#{ { claims: USER_INFO_CLAIMS }.to_query }") def user_info(session) validate_session(session) @@ -24,11 +39,20 @@ def validate_session(session) def request_info(token) start_tracking - response = Net::HTTP.get_response(USER_INFO_URI, auth_header(token)) + response = Net::HTTP.get_response(USER_INFO_CLAIMS_URI, auth_header(token)) code = response.code.to_i case code when 200...299 - parsed_response(response) + user_info = parsed_response(response) + Rails.logger.info(['CLEAR userinfo response', + { sub: user_info&.dig('sub'), + email: user_info&.dig('email'), + email_verified: user_info&.dig('email_verified'), + given_name_present: user_info&.dig('given_name').present?, + family_name_present: user_info&.dig('family_name').present?, + ssn9_present: user_info&.dig('ssn9').present?, + social_security_number_present: user_info&.dig('social_security_number').present? }]) + user_info when 401 raise UserInfoServiceError, 'unauthorized' else @@ -54,10 +78,10 @@ def start_tracking Rails.logger.info( ['Calling Login.gov user_info', { login_dot_gov_request_method: :get, - login_dot_gov_request_url: USER_INFO_URI, + login_dot_gov_request_url: USER_INFO_CLAIMS_URI, login_dot_gov_request_method_name: :request_info }] ) - @tracker = NewRelic::Agent::Tracer.start_external_request_segment(library: 'Net::HTTP', uri: USER_INFO_URI, + @tracker = NewRelic::Agent::Tracer.start_external_request_segment(library: 'Net::HTTP', uri: USER_INFO_CLAIMS_URI, procedure: :get) end @@ -66,7 +90,7 @@ def finish_tracking(code) Rails.logger.info( ['Login.gov user_info response info', { login_dot_gov_request_method: :get, - login_dot_gov_request_url: USER_INFO_URI, + login_dot_gov_request_url: USER_INFO_CLAIMS_URI, login_dot_gov_request_method_name: :request_info, login_dot_gov_response_status_code: code, login_dot_gov_response_duration: Time.now - @start }] diff --git a/dpc-portal/app/views/layouts/application.html.erb b/dpc-portal/app/views/layouts/application.html.erb index edaa440f11..abd97bcccb 100644 --- a/dpc-portal/app/views/layouts/application.html.erb +++ b/dpc-portal/app/views/layouts/application.html.erb @@ -26,7 +26,7 @@ - <% if user_signed_in? %> + <% if !!current_user %> <%= auto_session_timeout_js %> <% end %>