fedora-infra / noggin Goto Github PK

Self-service user portal for open-source communities to use over FreeIPA.

License: MIT License

Python 73.81% CSS 5.37% HTML 19.96% Shell 0.46% JavaScript 0.25% Dockerfile 0.11% Gherkin 0.04%

self-service freeipa idm fedora portal securitas community open-source

noggin's Introduction

Noggin

noggin is a self-service portal for FreeIPA. The primary purpose of the portal is to allow users to sign up and manage their account information and group membership.

The documentation is available online at https://noggin-aaa.readthedocs.io/

noggin's People

Contributors

Stargazers

Watchers

noggin's Issues

Import script

As a newly registered user, I want to agree to the FPCA so that I can proceed to join other groups that require it

As a developer, I want to find out how to reset a users password securely

Acceptance Criteria:
Investigation ( Spike ) How we do this as this a main feature that is not in the portal currently.
Reach out to @tiran & @puiterwijk to get some insight into the best way to do it
Document the best approaches and add link to document to this user story

Definition of done:
Identified a solution(s) to share with team for feedback for a decision to be made to allow TM to progress with user story?

Notes: https://www.freeipa.org/page/Self-Service_Password_Reset.

As a user, I want to see who is in a group, so that I can see if my friends are in it.

As a contributor (in any capacity), I want to request a new group, so that I can group together people working with me on my cool project.

FAS Client on Koji builder

As a user, i want to edit my personal details

As a registered user, I want to be able to edit my publicly visible information, so that I can keep my information up to date.

As a CentOS Sysadmin, I want to be able to generate node x509 certs without having to enroll them into IPA, due to security concerns (we just need x509 cert, nothing else).

(M) As a registered user, I want to disable my account, so that I can act within my GDPR rights.

AC:
We have a SAR script to list information about users in our repository
We have a means to link users to the pagure instance where they can request an account disable

DoD:
All prs implementing the above are merged and have been verified

As a registered user, I want to learn how to join a new group, so that I can participate in it and help out.

Acceptance Criteria:

Generic note ""Want to join this group? Talk to one of these people for information" to be added to the group page near the sponsor list

DOD:

AC complete

Est S

proxy authentication from the portal to IPA

As a CentOS packager, I want my certificate-based auth workflow to continue working, so that I can continue contributing and being awesome.

As a user, i want to see detailed information about a group

Investigate what needs to be done with fedmsg consumers using a fas client

fedora-messaging integration

Setup and Configure an Ipsilon instance that uses a FreeIPA backend

As a group owner, i want to add a user to a group

As a user, I want to see public account details for a user, so that I can find out if they are the right person to contact for my question.

Identify what they are using that dummy user for

As a registered user, I want to be able to add and remove SSH keys from my account, so that I can access Fedora systems with my current keys and disable access from old keys.

As a registered user, I want to change my password, so that I can be a responsible person who cares about security.

AC:

A logged-in user can change their password following
They need to provide the current password again for additional security, which is checked against FreeIPA
The password is changed in FreeIPA
They don't need to login again after changing it
A log message is emitted for audit reasons.

DoD:
all the above are met.

As a registered user, I want to temporarily disable my account, so that I can come back later if I decide to.

Acceptance Criteria:
Spike what happens when a user is disabled and they try to login
DOD
Above is complete

As a Fedora packager, I want my Kerberos-based auth workflow for Koji to continue working, so that I can continue packaging packages.

As a user, i want to see detailed information about another individual user

As a group owner, i want to remove a user from a group

As a user, i want to join / request to join a group

As an AAA administrator, I want to disable accounts, so that the bad person no longer has access to our systems.

As an AAA administrator, I want to create a new group, so that the person who requested it is happy.

As a group sponsor, I want to add new users to my group, so that the new users can access resources permitted to group members.

As a group owner, i want to approve requests to join a group

As a complete newcomer to Fedora or CentOS, I want to be able to register so that I can contribute to the project in some way.

As a community member (in any capacity), I want spammers to be curtailed ASAP, so that they don’t annoy me.

As a registered user, I want my email alias to work, so that I look fancy with a @fedoraproject.org address.

(S) As a AAA developer I want my PR to be automatically merged if they are approved and meet a certain standard so that I can focus on development work

Acceptance Criteria

Project is using Mergify to automate the PR merging.
Mergify is configure to require the CI to pass and 1 person to approve the PR

DOD
As above

As a user, i want to browse or search all groups

(S) IPA Server- Investigate what we need to do

Acceptance Criteria:

Identify/ document what we need to do
List of steps

Definition of done:
All of the above completed

As a user, i want to view a list of group membership requests that are still pending approval

As a user, I want to see who is responsible for a group, so that I can contact them to report an issue.

As a registered user, I want to log into a web application with my AAA account, so that I can use the application to do cool things.

Technology to use - decision

This was discussed and a decision was made to work with known tech. See note below:

We discussed the building of the login functionality with known tech (Python + Jinja templates) or new tech (Python Backend + Javascript One Page App).We measured value versus effort and decided that the extra effort is far higher than the extra value gained by the user if we build AAA using new technology.

The team has also decided to build AAA with known technology Python due to:

Critical functionality for user
Tight timeline
Possibility of creating more bugs
Limited time for knowledge share
If we migrate to Javascript at later releases we will not need to start from scratch
Greater possibility of releasing at end of Q1.

It was noted that the team would like to work with new technology but because of the considerations above, that this was not the right project to adopt new technology.