Updated fence to expose metrics

[emalinowski]

Link to Jira ticket if there is one:

Environments

Description of changes

Updated fence to expose metrics

[github-actions]

microbiome.diseasedatahub.org

❌ etlMapping.yaml - gitops.json mismatch

• Field error: Field [status] in explorerConfig.charts not found in etlMapping

[github-actions]

accessclinicaldata.niaid.nih.gov/manifest.json

Deployment changes

• fence
  • Requires database migration (Remove Foreign Key Constraints for Service Account fence#1172)

Breaking changes

• fence
  • New Database Migration (using alembic) was added and is required. (Chore/pps-301 fence#1114)

aids.diseasedatahub.org/manifest.json

⚠️ Services on branch

• revproxy

Deployment changes

• fence
  • Requires database migration (Remove Foreign Key Constraints for Service Account fence#1172)
  • Deployment changes to enable this feature for commons are described here https://github.com/uc-cdis/fence/blob/e36f6574ade17bb8c9c0c9df8801f9a59de423b1/docs/fence_multifactor_authentication_guide.md (feat(DCF-1446): Assign MFA policy on login fence#1106)
  • Update fence-config.yaml to include parent_to_child_studies_mapping to define parent/child relationships within the dbGaP block of the config. (feat(PXP-10776): Cascading Authorization fence#1102)
  • Allow setting INDEXD_PASSWORD via environment variable. (allow setting INDEXD_PASSWORD via env var fence#1092)
  • Systems that use visas parsing must update their Fence configuration to set ENABLE_VISA_UPDATE_CRON to True and set GLOBAL_PARSE_VISAS_ON_LOGIN to either True or None (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Requires a Fence DB migration (PXP-10541 Client credentials rotation fence#1068)
  • Configure the ALLOWED_DATA_UPLOAD_BUCKETS setting to allow users to upload to buckets other than DATA_UPLOAD_BUCKET (PXP-10361 Allow specifying the upload bucket fence#1051)
  • B/c the default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP, you MUST ensure that an instance that should comply with FedRAMP does NOT override this fence configuration (e.g. it should be 15 minutes) SESSION_TIMEOUT: 900 (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • Requires a Fence DB migration (Client.redirect_uri is now optional) (PXP-10113 Client credentials grant fence#1033)
  • Requires database migration for a new table to Fence, google Access expiration to add new expires column, and to create iss_sub_pair_to_user table Update manifest.json #968 updated BRAIN production data model to 1.0.0 #963 feat(stage-tiered-access): Updated portal versions to fix tiered acce… #973 (Feat/passport fence#964)
  • Requires Arborist >= 2022.04 OR >=3.4.0 (PXP-9480): Support merge param for PUT /resource endpoint arborist#143 (Feat/passport fence#964)
  • To enable Passports -> DRS in an environment you must update Fence Configuration to at a minimum specify GA4GH_PASSPORTS_TO_DRS_ENABLED: true (only do this after coordinating with the environment owner as this has several requirements before it can be enabled, including the need to use Indexd's authz field in ALL records rather than acl) (Feat/passport fence#964)
  • Requires a Fence DB migration (chore(migration): add authz column to project fence#1003)
  • Requires a database migration to create iss_sub_pair_to_user table ((PXP-8682): Add visa validation and sync for data download fence#973)
  • Google Access expiration requires a database migration to add new expires column! (feat(storage_expiration): add expires to db for Google access, create… fence#968)
  • Requires database migration. Adding a new table to Fence. ((PXP-8679): Add new db table and update login to add entries fence#963)
  • Requires these cloud-automation updates to revproxy: (PXP-7565): Exclude Fence register-user blueprint from CSRF check cloud-automation#1580 ((PXP-7565): User registration, plus CSRF changes fence#906)
  • By default Fence will allow only visas issued by RAS staging, RAS prod, and itself; if a different set of allowed visa issuers is needed, edit the GA4GH_VISA_ISSUER_ALLOWLIST config value. Otherwise, no action needed. ((PXP-6339): RAS visa validation fence#933)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence (You have to add any valid redirects to the client before deploying this) ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • For existing deployments with "ENABLE_AUDIT_LOGS" turned ON, to DISABLE pushing audit logs to an AWS SQS, the configuration "PUSH_AUDIT_LOGS_CONFIG.type" must be changed to "api" (default: "aws_sqs"). If audit-service has never been deployed, no action required. (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • To ENABLE pushing audit logs to an AWS SQS (REQUIRES audit-service 1.0.0 or more recent), create/update the configuration file's "PUSH_AUDIT_LOGS_CONFIG" field ("type: aws_sqs" (default), and the SQS URL and region can be copied from the audit-service configuration - or run gen3 sqs info $(gen3 api safe-name audit-sqs)), see https://github.com/uc-cdis/fence/blob/fec3dd937d68384e86b2ed6f9b53daf0026c2df9/fence/config-default.yaml#L632-L636. Then run kubectl delete secret fence-config and gen3 kube-setup-fence (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • This commit includes patches to allow old style refresh tokens and API keys to pass new style validation, while issuing new style refresh tokens and API keys. Since refresh tokens and API keys have a default TTL of 30 days, stay on this tag for 30 days if possible. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Old access tokens will NOT work once this is deployed so active sessions may be temporarily interrupted. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Audit logs for user logins and data downloads can be enabled by deploying the audit-service and adding setting ENABLE_AUDIT_LOGS to the fence config (see https://github.com/uc-cdis/fence/blob/1c850d07e54f8527dbde182fdd9dd593d18f660e/fence/config-default.yaml#L586-L588) (PXP-7447 audit-service integration fence#885)
  • REQUIRES A FENCE DB MIGRATION, since with this update there is now an additional column in the authorization_code table "refresh_token_expires_in" (Feat/refresh expires in fence#848)
  • Commons configured with RAS staging login must add the "discovery_url" fence config, because it now defaults to RAS prod (Fix/ras url fence#824)
  • If the fence config already has [CLIENT_, USER_, SESSION_]ALLOWED_SCOPES fields, and GA4GH AAI integration is desired, then add ga4gh_passport_v1 to all those lists. If default config values are being used then no change required. (PXP-6406 Feat/ga4gh scope fence#799)
  • To use the new Cognito integration, apply in fence config the changes made to config-default.yaml. Otherwise no action required. (PXP-5613 Feat/cognito fence#767)

Breaking changes

• fence
  • New Database Migration (using alembic) was added and is required. (Chore/pps-301 fence#1114)
  • Removed most Prometheus support (feat(google_update): updated Flask and deps, also don't fail early with Google errors PXP-10900 fence#1086)
  • The default value for the GLOBAL_PARSE_VISAS_ON_LOGIN setting is now False instead of None. By default, parsing visas on login is now disabled and the parse_visas parameter cannot be used (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. chore(jupyter-nde1.1.0) #988 (Feat/passport fence#964)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. (feat(passport-exp): handle expiration edge cases [PXP-9235] fence#988)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • Remove scopes from "aud" claim in Fence-issued tokens. This means that in general, old tokens (minted by previous Fence releases) will not pass validation by this Fence. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Access tokens will still include scopes for compatibility with other microservices, but scopes are no longer guaranteed and should no longer be expected in the aud claim from this version on. ID tokens, refresh tokens, and API keys will not have scopes in the aud claim. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add custom "scope" claim in tokens and put scopes there instead. Custom validation for scopes claim added in Authutils 6.0.1 (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add issuer to "aud" claim (alongside other aud values--so when there is a Fence client involved, this means the aud claim will include both Fence's BASE_URL and the client_id) (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Remove custom "aud" claim validation and use normal validation instead (by bumping to Authutils 6.0.1). This means checking that the aud claim contains a value that identifies the consuming service, i.e. Fence's BASE_URL. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • This Nginx status endpoint is a hard dependency for the nginx-prometheus-exporter side car. Any older fence image that is used with the Kubernetes deployment descriptor that is declared with the sidecar below will fail to come up. (chore(monitoring): Adopt new pybase img version. fence#817)
  • name: nginx-prometheus-exporter (chore(monitoring): Adopt new pybase img version. fence#817)
  • image: registry.hub.docker.com/nginx/nginx-prometheus-exporter:0.8.0 (chore(monitoring): Adopt new pybase img version. fence#817)
  • args: ["-nginx.scrape-uri", "http://127.0.0.1/nginx_status"] (chore(monitoring): Adopt new pybase img version. fence#817)
  • ports: (chore(monitoring): Adopt new pybase img version. fence#817)
  • containerPort: 9113 (chore(monitoring): Adopt new pybase img version. fence#817)
  • Usersync will no longer populate user's email field in Fence db with the user's username, UNLESS the username is an email address, in which case previous behavior applies (email field is populated with the username). In other words, nothing should change except in cases where usersync was putting invalid emails into user email fields anyway. (PXP-2802 feat(usync-emails) fence#788)

flu.diseasedatahub.org/manifest.json

⚠️ Services on branch

• revproxy

Deployment changes

• fence
  • Requires database migration (Remove Foreign Key Constraints for Service Account fence#1172)
  • Deployment changes to enable this feature for commons are described here https://github.com/uc-cdis/fence/blob/e36f6574ade17bb8c9c0c9df8801f9a59de423b1/docs/fence_multifactor_authentication_guide.md (feat(DCF-1446): Assign MFA policy on login fence#1106)
  • Update fence-config.yaml to include parent_to_child_studies_mapping to define parent/child relationships within the dbGaP block of the config. (feat(PXP-10776): Cascading Authorization fence#1102)
  • Allow setting INDEXD_PASSWORD via environment variable. (allow setting INDEXD_PASSWORD via env var fence#1092)
  • Systems that use visas parsing must update their Fence configuration to set ENABLE_VISA_UPDATE_CRON to True and set GLOBAL_PARSE_VISAS_ON_LOGIN to either True or None (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Requires a Fence DB migration (PXP-10541 Client credentials rotation fence#1068)
  • Configure the ALLOWED_DATA_UPLOAD_BUCKETS setting to allow users to upload to buckets other than DATA_UPLOAD_BUCKET (PXP-10361 Allow specifying the upload bucket fence#1051)
  • B/c the default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP, you MUST ensure that an instance that should comply with FedRAMP does NOT override this fence configuration (e.g. it should be 15 minutes) SESSION_TIMEOUT: 900 (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • Requires a Fence DB migration (Client.redirect_uri is now optional) (PXP-10113 Client credentials grant fence#1033)
  • Requires database migration for a new table to Fence, google Access expiration to add new expires column, and to create iss_sub_pair_to_user table Update manifest.json #968 updated BRAIN production data model to 1.0.0 #963 feat(stage-tiered-access): Updated portal versions to fix tiered acce… #973 (Feat/passport fence#964)
  • Requires Arborist >= 2022.04 OR >=3.4.0 (PXP-9480): Support merge param for PUT /resource endpoint arborist#143 (Feat/passport fence#964)
  • To enable Passports -> DRS in an environment you must update Fence Configuration to at a minimum specify GA4GH_PASSPORTS_TO_DRS_ENABLED: true (only do this after coordinating with the environment owner as this has several requirements before it can be enabled, including the need to use Indexd's authz field in ALL records rather than acl) (Feat/passport fence#964)
  • Requires a Fence DB migration (chore(migration): add authz column to project fence#1003)
  • Requires a database migration to create iss_sub_pair_to_user table ((PXP-8682): Add visa validation and sync for data download fence#973)
  • Google Access expiration requires a database migration to add new expires column! (feat(storage_expiration): add expires to db for Google access, create… fence#968)
  • Requires database migration. Adding a new table to Fence. ((PXP-8679): Add new db table and update login to add entries fence#963)
  • Requires these cloud-automation updates to revproxy: (PXP-7565): Exclude Fence register-user blueprint from CSRF check cloud-automation#1580 ((PXP-7565): User registration, plus CSRF changes fence#906)
  • By default Fence will allow only visas issued by RAS staging, RAS prod, and itself; if a different set of allowed visa issuers is needed, edit the GA4GH_VISA_ISSUER_ALLOWLIST config value. Otherwise, no action needed. ((PXP-6339): RAS visa validation fence#933)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence (You have to add any valid redirects to the client before deploying this) ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • For existing deployments with "ENABLE_AUDIT_LOGS" turned ON, to DISABLE pushing audit logs to an AWS SQS, the configuration "PUSH_AUDIT_LOGS_CONFIG.type" must be changed to "api" (default: "aws_sqs"). If audit-service has never been deployed, no action required. (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • To ENABLE pushing audit logs to an AWS SQS (REQUIRES audit-service 1.0.0 or more recent), create/update the configuration file's "PUSH_AUDIT_LOGS_CONFIG" field ("type: aws_sqs" (default), and the SQS URL and region can be copied from the audit-service configuration - or run gen3 sqs info $(gen3 api safe-name audit-sqs)), see https://github.com/uc-cdis/fence/blob/fec3dd937d68384e86b2ed6f9b53daf0026c2df9/fence/config-default.yaml#L632-L636. Then run kubectl delete secret fence-config and gen3 kube-setup-fence (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • This commit includes patches to allow old style refresh tokens and API keys to pass new style validation, while issuing new style refresh tokens and API keys. Since refresh tokens and API keys have a default TTL of 30 days, stay on this tag for 30 days if possible. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Old access tokens will NOT work once this is deployed so active sessions may be temporarily interrupted. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Audit logs for user logins and data downloads can be enabled by deploying the audit-service and adding setting ENABLE_AUDIT_LOGS to the fence config (see https://github.com/uc-cdis/fence/blob/1c850d07e54f8527dbde182fdd9dd593d18f660e/fence/config-default.yaml#L586-L588) (PXP-7447 audit-service integration fence#885)
  • REQUIRES A FENCE DB MIGRATION, since with this update there is now an additional column in the authorization_code table "refresh_token_expires_in" (Feat/refresh expires in fence#848)
  • Commons configured with RAS staging login must add the "discovery_url" fence config, because it now defaults to RAS prod (Fix/ras url fence#824)
  • If the fence config already has [CLIENT_, USER_, SESSION_]ALLOWED_SCOPES fields, and GA4GH AAI integration is desired, then add ga4gh_passport_v1 to all those lists. If default config values are being used then no change required. (PXP-6406 Feat/ga4gh scope fence#799)
  • To use the new Cognito integration, apply in fence config the changes made to config-default.yaml. Otherwise no action required. (PXP-5613 Feat/cognito fence#767)

Breaking changes

• fence
  • New Database Migration (using alembic) was added and is required. (Chore/pps-301 fence#1114)
  • Removed most Prometheus support (feat(google_update): updated Flask and deps, also don't fail early with Google errors PXP-10900 fence#1086)
  • The default value for the GLOBAL_PARSE_VISAS_ON_LOGIN setting is now False instead of None. By default, parsing visas on login is now disabled and the parse_visas parameter cannot be used (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. chore(jupyter-nde1.1.0) #988 (Feat/passport fence#964)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. (feat(passport-exp): handle expiration edge cases [PXP-9235] fence#988)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • Remove scopes from "aud" claim in Fence-issued tokens. This means that in general, old tokens (minted by previous Fence releases) will not pass validation by this Fence. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Access tokens will still include scopes for compatibility with other microservices, but scopes are no longer guaranteed and should no longer be expected in the aud claim from this version on. ID tokens, refresh tokens, and API keys will not have scopes in the aud claim. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add custom "scope" claim in tokens and put scopes there instead. Custom validation for scopes claim added in Authutils 6.0.1 (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add issuer to "aud" claim (alongside other aud values--so when there is a Fence client involved, this means the aud claim will include both Fence's BASE_URL and the client_id) (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Remove custom "aud" claim validation and use normal validation instead (by bumping to Authutils 6.0.1). This means checking that the aud claim contains a value that identifies the consuming service, i.e. Fence's BASE_URL. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • This Nginx status endpoint is a hard dependency for the nginx-prometheus-exporter side car. Any older fence image that is used with the Kubernetes deployment descriptor that is declared with the sidecar below will fail to come up. (chore(monitoring): Adopt new pybase img version. fence#817)
  • name: nginx-prometheus-exporter (chore(monitoring): Adopt new pybase img version. fence#817)
  • image: registry.hub.docker.com/nginx/nginx-prometheus-exporter:0.8.0 (chore(monitoring): Adopt new pybase img version. fence#817)
  • args: ["-nginx.scrape-uri", "http://127.0.0.1/nginx_status"] (chore(monitoring): Adopt new pybase img version. fence#817)
  • ports: (chore(monitoring): Adopt new pybase img version. fence#817)
  • containerPort: 9113 (chore(monitoring): Adopt new pybase img version. fence#817)
  • Usersync will no longer populate user's email field in Fence db with the user's username, UNLESS the username is an email address, in which case previous behavior applies (email field is populated with the username). In other words, nothing should change except in cases where usersync was putting invalid emails into user email fields anyway. (PXP-2802 feat(usync-emails) fence#788)

microbiome.diseasedatahub.org/manifest.json

⚠️ Services on branch

• manifestservice
• revproxy
• sower
• dashboard
• ssjdispatcher.job_images.indexing
• sower.container.image.pelican

Deployment changes

• fence
  • Requires database migration (Remove Foreign Key Constraints for Service Account fence#1172)
  • Deployment changes to enable this feature for commons are described here https://github.com/uc-cdis/fence/blob/e36f6574ade17bb8c9c0c9df8801f9a59de423b1/docs/fence_multifactor_authentication_guide.md (feat(DCF-1446): Assign MFA policy on login fence#1106)
  • Update fence-config.yaml to include parent_to_child_studies_mapping to define parent/child relationships within the dbGaP block of the config. (feat(PXP-10776): Cascading Authorization fence#1102)
  • Allow setting INDEXD_PASSWORD via environment variable. (allow setting INDEXD_PASSWORD via env var fence#1092)
  • Systems that use visas parsing must update their Fence configuration to set ENABLE_VISA_UPDATE_CRON to True and set GLOBAL_PARSE_VISAS_ON_LOGIN to either True or None (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Requires a Fence DB migration (PXP-10541 Client credentials rotation fence#1068)
  • Configure the ALLOWED_DATA_UPLOAD_BUCKETS setting to allow users to upload to buckets other than DATA_UPLOAD_BUCKET (PXP-10361 Allow specifying the upload bucket fence#1051)
  • B/c the default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP, you MUST ensure that an instance that should comply with FedRAMP does NOT override this fence configuration (e.g. it should be 15 minutes) SESSION_TIMEOUT: 900 (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • Requires a Fence DB migration (Client.redirect_uri is now optional) (PXP-10113 Client credentials grant fence#1033)
  • Requires database migration for a new table to Fence, google Access expiration to add new expires column, and to create iss_sub_pair_to_user table Update manifest.json #968 updated BRAIN production data model to 1.0.0 #963 feat(stage-tiered-access): Updated portal versions to fix tiered acce… #973 (Feat/passport fence#964)
  • Requires Arborist >= 2022.04 OR >=3.4.0 (PXP-9480): Support merge param for PUT /resource endpoint arborist#143 (Feat/passport fence#964)
  • To enable Passports -> DRS in an environment you must update Fence Configuration to at a minimum specify GA4GH_PASSPORTS_TO_DRS_ENABLED: true (only do this after coordinating with the environment owner as this has several requirements before it can be enabled, including the need to use Indexd's authz field in ALL records rather than acl) (Feat/passport fence#964)
  • Requires a Fence DB migration (chore(migration): add authz column to project fence#1003)
  • Requires a database migration to create iss_sub_pair_to_user table ((PXP-8682): Add visa validation and sync for data download fence#973)
  • Google Access expiration requires a database migration to add new expires column! (feat(storage_expiration): add expires to db for Google access, create… fence#968)
  • Requires database migration. Adding a new table to Fence. ((PXP-8679): Add new db table and update login to add entries fence#963)
  • Requires these cloud-automation updates to revproxy: (PXP-7565): Exclude Fence register-user blueprint from CSRF check cloud-automation#1580 ((PXP-7565): User registration, plus CSRF changes fence#906)
  • By default Fence will allow only visas issued by RAS staging, RAS prod, and itself; if a different set of allowed visa issuers is needed, edit the GA4GH_VISA_ISSUER_ALLOWLIST config value. Otherwise, no action needed. ((PXP-6339): RAS visa validation fence#933)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence (You have to add any valid redirects to the client before deploying this) ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • For existing deployments with "ENABLE_AUDIT_LOGS" turned ON, to DISABLE pushing audit logs to an AWS SQS, the configuration "PUSH_AUDIT_LOGS_CONFIG.type" must be changed to "api" (default: "aws_sqs"). If audit-service has never been deployed, no action required. (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • To ENABLE pushing audit logs to an AWS SQS (REQUIRES audit-service 1.0.0 or more recent), create/update the configuration file's "PUSH_AUDIT_LOGS_CONFIG" field ("type: aws_sqs" (default), and the SQS URL and region can be copied from the audit-service configuration - or run gen3 sqs info $(gen3 api safe-name audit-sqs)), see https://github.com/uc-cdis/fence/blob/fec3dd937d68384e86b2ed6f9b53daf0026c2df9/fence/config-default.yaml#L632-L636. Then run kubectl delete secret fence-config and gen3 kube-setup-fence (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • This commit includes patches to allow old style refresh tokens and API keys to pass new style validation, while issuing new style refresh tokens and API keys. Since refresh tokens and API keys have a default TTL of 30 days, stay on this tag for 30 days if possible. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Old access tokens will NOT work once this is deployed so active sessions may be temporarily interrupted. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Audit logs for user logins and data downloads can be enabled by deploying the audit-service and adding setting ENABLE_AUDIT_LOGS to the fence config (see https://github.com/uc-cdis/fence/blob/1c850d07e54f8527dbde182fdd9dd593d18f660e/fence/config-default.yaml#L586-L588) (PXP-7447 audit-service integration fence#885)
  • REQUIRES A FENCE DB MIGRATION, since with this update there is now an additional column in the authorization_code table "refresh_token_expires_in" (Feat/refresh expires in fence#848)
  • Commons configured with RAS staging login must add the "discovery_url" fence config, because it now defaults to RAS prod (Fix/ras url fence#824)
  • If the fence config already has [CLIENT_, USER_, SESSION_]ALLOWED_SCOPES fields, and GA4GH AAI integration is desired, then add ga4gh_passport_v1 to all those lists. If default config values are being used then no change required. (PXP-6406 Feat/ga4gh scope fence#799)
  • To use the new Cognito integration, apply in fence config the changes made to config-default.yaml. Otherwise no action required. (PXP-5613 Feat/cognito fence#767)

Breaking changes

• fence
  • New Database Migration (using alembic) was added and is required. (Chore/pps-301 fence#1114)
  • Removed most Prometheus support (feat(google_update): updated Flask and deps, also don't fail early with Google errors PXP-10900 fence#1086)
  • The default value for the GLOBAL_PARSE_VISAS_ON_LOGIN setting is now False instead of None. By default, parsing visas on login is now disabled and the parse_visas parameter cannot be used (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. chore(jupyter-nde1.1.0) #988 (Feat/passport fence#964)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. (feat(passport-exp): handle expiration edge cases [PXP-9235] fence#988)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • Remove scopes from "aud" claim in Fence-issued tokens. This means that in general, old tokens (minted by previous Fence releases) will not pass validation by this Fence. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Access tokens will still include scopes for compatibility with other microservices, but scopes are no longer guaranteed and should no longer be expected in the aud claim from this version on. ID tokens, refresh tokens, and API keys will not have scopes in the aud claim. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add custom "scope" claim in tokens and put scopes there instead. Custom validation for scopes claim added in Authutils 6.0.1 (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add issuer to "aud" claim (alongside other aud values--so when there is a Fence client involved, this means the aud claim will include both Fence's BASE_URL and the client_id) (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Remove custom "aud" claim validation and use normal validation instead (by bumping to Authutils 6.0.1). This means checking that the aud claim contains a value that identifies the consuming service, i.e. Fence's BASE_URL. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • This Nginx status endpoint is a hard dependency for the nginx-prometheus-exporter side car. Any older fence image that is used with the Kubernetes deployment descriptor that is declared with the sidecar below will fail to come up. (chore(monitoring): Adopt new pybase img version. fence#817)
  • name: nginx-prometheus-exporter (chore(monitoring): Adopt new pybase img version. fence#817)
  • image: registry.hub.docker.com/nginx/nginx-prometheus-exporter:0.8.0 (chore(monitoring): Adopt new pybase img version. fence#817)
  • args: ["-nginx.scrape-uri", "http://127.0.0.1/nginx_status"] (chore(monitoring): Adopt new pybase img version. fence#817)
  • ports: (chore(monitoring): Adopt new pybase img version. fence#817)
  • containerPort: 9113 (chore(monitoring): Adopt new pybase img version. fence#817)
  • Usersync will no longer populate user's email field in Fence db with the user's username, UNLESS the username is an email address, in which case previous behavior applies (email field is populated with the username). In other words, nothing should change except in cases where usersync was putting invalid emails into user email fields anyway. (PXP-2802 feat(usync-emails) fence#788)

tb.diseasedatahub.org/manifest.json

⚠️ Services on branch

• revproxy

Deployment changes

• fence
  • Requires database migration (Remove Foreign Key Constraints for Service Account fence#1172)
  • Deployment changes to enable this feature for commons are described here https://github.com/uc-cdis/fence/blob/e36f6574ade17bb8c9c0c9df8801f9a59de423b1/docs/fence_multifactor_authentication_guide.md (feat(DCF-1446): Assign MFA policy on login fence#1106)
  • Update fence-config.yaml to include parent_to_child_studies_mapping to define parent/child relationships within the dbGaP block of the config. (feat(PXP-10776): Cascading Authorization fence#1102)
  • Allow setting INDEXD_PASSWORD via environment variable. (allow setting INDEXD_PASSWORD via env var fence#1092)
  • Systems that use visas parsing must update their Fence configuration to set ENABLE_VISA_UPDATE_CRON to True and set GLOBAL_PARSE_VISAS_ON_LOGIN to either True or None (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Requires a Fence DB migration (PXP-10541 Client credentials rotation fence#1068)
  • Configure the ALLOWED_DATA_UPLOAD_BUCKETS setting to allow users to upload to buckets other than DATA_UPLOAD_BUCKET (PXP-10361 Allow specifying the upload bucket fence#1051)
  • B/c the default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP, you MUST ensure that an instance that should comply with FedRAMP does NOT override this fence configuration (e.g. it should be 15 minutes) SESSION_TIMEOUT: 900 (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • Requires a Fence DB migration (Client.redirect_uri is now optional) (PXP-10113 Client credentials grant fence#1033)
  • Requires database migration for a new table to Fence, google Access expiration to add new expires column, and to create iss_sub_pair_to_user table Update manifest.json #968 updated BRAIN production data model to 1.0.0 #963 feat(stage-tiered-access): Updated portal versions to fix tiered acce… #973 (Feat/passport fence#964)
  • Requires Arborist >= 2022.04 OR >=3.4.0 (PXP-9480): Support merge param for PUT /resource endpoint arborist#143 (Feat/passport fence#964)
  • To enable Passports -> DRS in an environment you must update Fence Configuration to at a minimum specify GA4GH_PASSPORTS_TO_DRS_ENABLED: true (only do this after coordinating with the environment owner as this has several requirements before it can be enabled, including the need to use Indexd's authz field in ALL records rather than acl) (Feat/passport fence#964)
  • Requires a Fence DB migration (chore(migration): add authz column to project fence#1003)
  • Requires a database migration to create iss_sub_pair_to_user table ((PXP-8682): Add visa validation and sync for data download fence#973)
  • Google Access expiration requires a database migration to add new expires column! (feat(storage_expiration): add expires to db for Google access, create… fence#968)
  • Requires database migration. Adding a new table to Fence. ((PXP-8679): Add new db table and update login to add entries fence#963)
  • Requires these cloud-automation updates to revproxy: (PXP-7565): Exclude Fence register-user blueprint from CSRF check cloud-automation#1580 ((PXP-7565): User registration, plus CSRF changes fence#906)
  • By default Fence will allow only visas issued by RAS staging, RAS prod, and itself; if a different set of allowed visa issuers is needed, edit the GA4GH_VISA_ISSUER_ALLOWLIST config value. Otherwise, no action needed. ((PXP-6339): RAS visa validation fence#933)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence (You have to add any valid redirects to the client before deploying this) ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • For existing deployments with "ENABLE_AUDIT_LOGS" turned ON, to DISABLE pushing audit logs to an AWS SQS, the configuration "PUSH_AUDIT_LOGS_CONFIG.type" must be changed to "api" (default: "aws_sqs"). If audit-service has never been deployed, no action required. (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • To ENABLE pushing audit logs to an AWS SQS (REQUIRES audit-service 1.0.0 or more recent), create/update the configuration file's "PUSH_AUDIT_LOGS_CONFIG" field ("type: aws_sqs" (default), and the SQS URL and region can be copied from the audit-service configuration - or run gen3 sqs info $(gen3 api safe-name audit-sqs)), see https://github.com/uc-cdis/fence/blob/fec3dd937d68384e86b2ed6f9b53daf0026c2df9/fence/config-default.yaml#L632-L636. Then run kubectl delete secret fence-config and gen3 kube-setup-fence (PXP-7805 Push audit logs to an AWS SQS fence#923)
  • This commit includes patches to allow old style refresh tokens and API keys to pass new style validation, while issuing new style refresh tokens and API keys. Since refresh tokens and API keys have a default TTL of 30 days, stay on this tag for 30 days if possible. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Old access tokens will NOT work once this is deployed so active sessions may be temporarily interrupted. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Audit logs for user logins and data downloads can be enabled by deploying the audit-service and adding setting ENABLE_AUDIT_LOGS to the fence config (see https://github.com/uc-cdis/fence/blob/1c850d07e54f8527dbde182fdd9dd593d18f660e/fence/config-default.yaml#L586-L588) (PXP-7447 audit-service integration fence#885)
  • REQUIRES A FENCE DB MIGRATION, since with this update there is now an additional column in the authorization_code table "refresh_token_expires_in" (Feat/refresh expires in fence#848)
  • Commons configured with RAS staging login must add the "discovery_url" fence config, because it now defaults to RAS prod (Fix/ras url fence#824)
  • If the fence config already has [CLIENT_, USER_, SESSION_]ALLOWED_SCOPES fields, and GA4GH AAI integration is desired, then add ga4gh_passport_v1 to all those lists. If default config values are being used then no change required. (PXP-6406 Feat/ga4gh scope fence#799)
  • To use the new Cognito integration, apply in fence config the changes made to config-default.yaml. Otherwise no action required. (PXP-5613 Feat/cognito fence#767)

Breaking changes

• fence
  • New Database Migration (using alembic) was added and is required. (Chore/pps-301 fence#1114)
  • Removed most Prometheus support (feat(google_update): updated Flask and deps, also don't fail early with Google errors PXP-10900 fence#1086)
  • The default value for the GLOBAL_PARSE_VISAS_ON_LOGIN setting is now False instead of None. By default, parsing visas on login is now disabled and the parse_visas parameter cannot be used (GPE-891 Add ENABLE_VISA_UPDATE_CRON setting fence#1087)
  • Default session expiration changed from 30 minutes to 15 minutes to comply with FedRAMP (feat(session): change default to 15 minutes [PPS-122] fence#1040)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. chore(jupyter-nde1.1.0) #988 (Feat/passport fence#964)
  • URL Signing when no_force_sign query param is provided: Previously Fence would make a decision based off if the data was public and no_force_sign provided. Fence will now NEVER sign if no_force_sign is provided (since the concept of "public" data has been abstracted out of Fence. Data access - public or not - is the sole responsibility of the policy engine). In other words, if no_force_sign is provided at the API level, Fence will respect that regardless of whether the resulting URL will actually work. The default Fence behavior should remain the same. (feat(passport-exp): handle expiration edge cases [PXP-9235] fence#988)
  • /link/google will DENY requests with "redirect" param values that aren't in the "allowed redirects" for OAuth2/OIDC Clients in Fence ((PXP-8286): fix(google): add redirect validation to /link/google fence#927)
  • Remove scopes from "aud" claim in Fence-issued tokens. This means that in general, old tokens (minted by previous Fence releases) will not pass validation by this Fence. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Access tokens will still include scopes for compatibility with other microservices, but scopes are no longer guaranteed and should no longer be expected in the aud claim from this version on. ID tokens, refresh tokens, and API keys will not have scopes in the aud claim. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add custom "scope" claim in tokens and put scopes there instead. Custom validation for scopes claim added in Authutils 6.0.1 (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Add issuer to "aud" claim (alongside other aud values--so when there is a Fence client involved, this means the aud claim will include both Fence's BASE_URL and the client_id) (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • Remove custom "aud" claim validation and use normal validation instead (by bumping to Authutils 6.0.1). This means checking that the aud claim contains a value that identifies the consuming service, i.e. Fence's BASE_URL. (PXP-6617 Remove scopes from aud claim in tokens fence#839)
  • This Nginx status endpoint is a hard dependency for the nginx-prometheus-exporter side car. Any older fence image that is used with the Kubernetes deployment descriptor that is declared with the sidecar below will fail to come up. (chore(monitoring): Adopt new pybase img version. fence#817)
  • name: nginx-prometheus-exporter (chore(monitoring): Adopt new pybase img version. fence#817)
  • image: registry.hub.docker.com/nginx/nginx-prometheus-exporter:0.8.0 (chore(monitoring): Adopt new pybase img version. fence#817)
  • args: ["-nginx.scrape-uri", "http://127.0.0.1/nginx_status"] (chore(monitoring): Adopt new pybase img version. fence#817)
  • ports: (chore(monitoring): Adopt new pybase img version. fence#817)
  • containerPort: 9113 (chore(monitoring): Adopt new pybase img version. fence#817)
  • Usersync will no longer populate user's email field in Fence db with the user's username, UNLESS the username is an email address, in which case previous behavior applies (email field is populated with the username). In other words, nothing should change except in cases where usersync was putting invalid emails into user email fields anyway. (PXP-2802 feat(usync-emails) fence#788)

[frankliuao]

Metrics needed. Approved.