CCM-7650: CIS2 federation POC

.gitignore

@@ -61,6 +61,7 @@ tests/test-team/test-results/
 tests/test-team/playwright-report/
 tests/test-team/blob-report/
 tests/test-team/playwright/.cache/
+*.webm
 
 #plugin-cache
 plugin-cache/

infrastructure/terraform/components/app/cognito_identity_pool.tf

@@ -1,6 +1,6 @@
 resource "aws_cognito_identity_pool" "main" {
   identity_pool_name               = local.csi
-  allow_unauthenticated_identities = true
+  allow_unauthenticated_identities = false
 
   cognito_identity_providers {
     client_id               = aws_cognito_user_pool_client.main.id

infrastructure/terraform/components/app/cognito_identity_provider_cis2.tf

@@ -0,0 +1,31 @@
+data "aws_secretsmanager_secret_version" "current" {
+  secret_id = aws_secretsmanager_secret.cis2_client_credentials.id
+}
+
+resource "aws_cognito_identity_provider" "cis2_idp" {
+  count = var.enable_cis2_idp ? 1 : 0
+
+  user_pool_id  = aws_cognito_user_pool.main.id
+  provider_name = local.cis2_idp_name
+  provider_type = "OIDC"
+
+  provider_details = {
+    authorize_scopes          = "openid profile email nhsperson associatedorgs"
+    client_id                 = jsondecode(data.aws_secretsmanager_secret_version.current.secret_string)["client_id"]
+    client_secret             = jsondecode(data.aws_secretsmanager_secret_version.current.secret_string)["client_secret"]
+    oidc_issuer               = local.cis2_issuer_urls[var.cis2_environment]
+    attributes_request_method = "GET"
+  }
+
+  attribute_mapping = {
+    email                     = "email"
+    username                  = "sub"
+    given_name                = "given_name"
+    middle_name               = "middle_names"
+    family_name               = "family_name"
+    preferred_username        = "display_name"
+    "custom:idassurancelevel" = "idassurancelevel"
+    "custom:nhsid_user_orgs"  = "nhsid_user_orgs"
+    "custom:nhsid_useruid"    = "nhsid_useruid"
+  }
+}

infrastructure/terraform/components/app/cognito_user_pool.tf

@@ -6,4 +6,40 @@ resource "aws_cognito_user_pool" "main" {
   admin_create_user_config {
     allow_admin_create_user_only = true
   }
+
+  schema {
+    name                     = "idassurancelevel"
+    attribute_data_type      = "String"
+    developer_only_attribute = false
+    mutable                  = true
+    required                 = false
+    string_attribute_constraints {
+      min_length = 0
+      max_length = 2048
+    }
+  }
+
+  schema {
+    name                     = "nhsid_user_orgs"
+    attribute_data_type      = "String"
+    developer_only_attribute = false
+    mutable                  = true
+    required                 = false
+    string_attribute_constraints {
+      min_length = 0
+      max_length = 2048
+    }
+  }
+
+  schema {
+    name                     = "nhsid_useruid"
+    attribute_data_type      = "String"
+    developer_only_attribute = false
+    mutable                  = true
+    required                 = false
+    string_attribute_constraints {
+      min_length = 0
+      max_length = 2048
+    }
+  }
 }

infrastructure/terraform/components/app/cognito_user_pool_client.tf

@@ -10,16 +10,15 @@ resource "aws_cognito_user_pool_client" "main" {
     ]
   ])
 
-  supported_identity_providers = flatten([
-    var.enable_cognito_built_in_idp ? ["COGNITO"] : [],
-    # identity_provider_names.provider.provider_name   #e.g. auth0
-  ])
+  supported_identity_providers = flatten(
+    concat(local.cognito_idp, local.cis2_idp)
+  )
 
-  allowed_oauth_flows = ["code"]
+  allowed_oauth_flows_user_pool_client = true
+  allowed_oauth_flows                  = ["code"]
   allowed_oauth_scopes = [
     "openid",
     "email",
-    "phone",
     "profile",
     "aws.cognito.signin.user.admin"
   ]

infrastructure/terraform/components/app/locals.tf

@@ -1,4 +1,12 @@
 locals {
   root_domain_name = "${var.environment}.${local.acct.dns_zone["name"]}"
   auth_domain_name = "auth.${local.root_domain_name}"
+  cis2_issuer_urls = {
+    mock : "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-int"
+    int : "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare"
+    live : "https://am.nhsidentity.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare"
+  }
+  cis2_idp_name = "CIS2-${var.cis2_environment}"
+  cognito_idp   = var.enable_cognito_built_in_idp ? ["COGNITO"] : []
+  cis2_idp      = var.enable_cis2_idp ? [local.cis2_idp_name] : []
 }

infrastructure/terraform/components/app/secretsmanager_secret_cis2_client_credentials.tf

@@ -0,0 +1,16 @@
+resource "aws_secretsmanager_secret" "cis2_client_credentials" {
+  name = "${var.environment}/federation/credentials/cis2-${var.cis2_environment}"
+}
+
+variable "placeholder_credentials" {
+  default = {
+    client_id     = "placeholder"
+    client_secret = "placeholder"
+  }
+  type = map(string)
+}
+
+resource "aws_secretsmanager_secret_version" "initialisation" {
+  secret_id     = aws_secretsmanager_secret.cis2_client_credentials.id
+  secret_string = jsonencode(var.placeholder_credentials)
+}

infrastructure/terraform/components/app/variables.tf

@@ -116,3 +116,20 @@ variable "disable_content" {
   description = "Value for turning switching disable content true/false"
   default     = "false"
 }
+
+variable "enable_cis2_idp" {
+  type        = bool
+  description = "Switch to enable the CIS2 Cognito federation"
+  default     = false
+}
+
+variable "cis2_environment" {
+  type        = string
+  description = "Name of the CIS2 environment, e.g. mock, int, live. See: https://digital.nhs.uk/services/care-identity-service/applications-and-services/cis2-authentication/guidance-for-developers/detailed-guidance/registration"
+  default     = ""
+
+  validation {
+    condition     = contains(["mock", "int", "live"], var.cis2_environment)
+    error_message = "Allowed values for cis2_environment are \"int\" or \"live\"."
+  }
+}