Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support for Google Account required authentication model #2021

Open
jpd236 opened this issue Feb 1, 2024 · 0 comments
Open

Support for Google Account required authentication model #2021

jpd236 opened this issue Feb 1, 2024 · 0 comments

Comments

@jpd236
Copy link
Contributor

jpd236 commented Feb 1, 2024

Currently, Jolly Roger has its own independent authentication system and set of accounts. In contrast, Ange Management currently requires that all team members have a Google Account. This enables the following:

  • Authentication by checking membership in the group. Unfortunately, there's no direct way I'm aware of to check membership in a regular consumer Google Group. Instead, we check for access to the hunt's drive folder, which is shared with the Google Group. To avoid having to request full Drive access, which is a scary OAuth scope, we only ask for per-file access and we use the Drive picker and ask users to select this year's hunt folder, which gives us access to that specific folder. This was implemented a few years ago - maybe there is a better way now. But it works.
  • No need to share spreadsheets with all users and risk running into limits. You can just share directly with the group, and users will show up as themselves (not anonymous) in the sheet.
  • No need for an email system since all of the existing emails relate to account creation and maintenance and being added to hunts, AFAICT.

FWIW, we also use a service account to create the sheets and perform other Google operations. IIRC the current system asks for a dedicated actual user account for this purpose. Service accounts feel better suited to this purpose.

Meteor has a built-in Google Account integration which might be useful (our current system is DIY). At a high level, I imagine offering this as a configurable option that replaces the existing log-in system with a "Sign in with Google" option; after signing in, we create a user entry in JR including any necessary credentials for authenticated requests. Would have to figure out things like the initial user creation flow for the admin, hunt creation creating folders and doing the per-hunt auth dance as needed.

I'm planning to take a look at this myself but concerns, thoughts and ideas would be welcome! I'd like to upstream this to avoid drift, and I think that Palindrome might find at least parts of this useful.
jpd236 added a commit to jpd236/jolly-roger that referenced this issue Feb 18, 2024
@jpd236
Add support for signing in with a Google Account.
307b80a 
Show a "Sign in with Google" button on the login page. This sign in flow
first attempts to match against existing users who have linked that same
Google Account. If there is no such user, a new account is created.

Icon taken from:
https://developers.google.com/identity/branding-guidelines

Notes / issues:

- This allows anyone to create a Jolly Roger account as long as they
have a Jolly Roger account; previously, access was invite only. This
seems reasonable in that hunts have their own ACLs, but if this is a
concern, we could reject new account creation until a follow-up change
which optionally configures access based on Drive folder access.

- A user can unlink their Google Account; if the user was originally
created through this flow, they will be left with an account with no
password or method of entry. However, they can follow the forgotten
password flow to create a new password (if an email server is
configured).

- At least on local instances, a console warning appears upon showing
the Google Account popup: "Cross-Origin-Opener-Policy policy would block
the window.closed call". This also occurs for the existing Google
Account integration so isn't exclusive to this flow.

- If the popup is closed without completing sign-in, the button remains
disabled because we don't appear to get a failure callback. I'm unsure
why this is happening, though it's easy enough to refresh the page.

- Sometimes, when you click Sign Out, the login page renders with a
blank "Sign in with Google" button, though the button appears to work as
expected.

See deathandmayhem#2021
@jpd236 jpd236 mentioned this issue Feb 18, 2024
Merged
jpd236 added a commit to jpd236/jolly-roger that referenced this issue Feb 20, 2024
@jpd236
Add support for signing in with a Google Account.
b436431 
Show a "Sign in with Google" button on the login page. This sign in flow
first attempts to match against existing users who have linked that same
Google Account. If there is no such user, the signup is rejected.

Icon taken from:
https://developers.google.com/identity/branding-guidelines

Notes / issues:

- A follow-up change will provide a way for users to be created with
this flow, likely via an ACL check against a Drive folder.

- In the future, if a user is created via this flow, they can unlink
their Google Account, leaving them with an account with no password or
method of entry. However, they can follow the forgotten password flow to
create a new password (if an email server is configured).

- At least on local instances, a console warning appears upon showing
the Google Account popup: "Cross-Origin-Opener-Policy policy would block
the window.closed call". This also occurs for the existing Google
Account integration so isn't exclusive to this flow.

- If the popup is closed without completing sign-in, the button remains
disabled because we don't appear to get a failure callback. I'm unsure
why this is happening, though it's easy enough to refresh the page.

- Sometimes, when you click Sign Out, the login page renders with a
blank "Sign in with Google" button, though the button appears to work as
expected.

See deathandmayhem#2021
jpd236 added a commit to jpd236/jolly-roger that referenced this issue Feb 20, 2024
@jpd236
Add support for signing in with a Google Account.
ae614ee 
Show a "Sign in with Google" button on the login page. This sign in flow
first attempts to match against existing users who have linked that same
Google Account. If there is no such user, the signup is rejected.

Icon taken from:
https://developers.google.com/identity/branding-guidelines

Notes / issues:

- A follow-up change will provide a way for users to be created with
this flow, likely via an ACL check against a Drive folder.

- In the future, if a user is created via this flow, they can unlink
their Google Account, leaving them with an account with no password or
method of entry. However, they can follow the forgotten password flow to
create a new password (if an email server is configured).

- At least on local instances, a console warning appears upon showing
the Google Account popup: "Cross-Origin-Opener-Policy policy would block
the window.closed call". This also occurs for the existing Google
Account integration so isn't exclusive to this flow.

- If the popup is closed without completing sign-in, the button remains
disabled because we don't appear to get a failure callback. I'm unsure
why this is happening, though it's easy enough to refresh the page.

- Sometimes, when you click Sign Out, the login page renders with a
blank "Sign in with Google" button, though the button appears to work as
expected.

See deathandmayhem#2021
jpd236 added a commit to jpd236/jolly-roger that referenced this issue Mar 4, 2024
@jpd236
Add support for signing in with a Google Account.
dc57101 
Show a "Sign in with Google" button on the login page. This sign in flow
first attempts to match against existing users who have linked that same
Google Account. If there is no such user, or multiple such users, the
request is rejected.

We use a custom login handler rather than the standard loginWithGoogle
module for simplicity since we already have existing linked users that
would be difficult to migrate to the standard system due to not storing
the necessary credentials. Since we have enough to validate identity in
our current schema, this is fine for now.

Icon taken from:
https://developers.google.com/identity/branding-guidelines

Notes / issues:

- This fixes a bug in the existing "unlink Google Account" flow where
the linked email is cleared but not the linked account ID.

- At least on local instances, a console warning appears upon showing
the Google Account popup: "Cross-Origin-Opener-Policy policy would block
the window.closed call". This also occurs for the existing Google
Account integration so isn't exclusive to this flow.

- Sometimes, when you click Sign Out, the login page renders with a
blank "Sign in with Google" button, though the button appears to work as
expected.

See deathandmayhem#2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jpd236