auth-server

Overview

The FDA MyStudies Auth server is the centralized authentication mechanism for the various client applications of the MyStudies platform.

The client applications are:

1. Android mobile application
2. iOS mobile application
3. Participant manager

The Auth serverprovides the following functionality:

1. User registration
2. User credentials management
3. User authentication
4. User logout
5. Server-to-server authentication support

The Auth server identity management application is built as a Spring Boot application that implements user login and consent flows. It integrates with your deployment’s instance of ORY Hydra for token generation and management.

Deployment

NOTE: Holistic deployment of the FDA MyStudies platform with Terraform and infrastructure-as-code is the recommended approach to deploying this component. A step-by-step guide to semi-automated deployment can be found in the deployment/ directory. The following instructions are provided in case manual deployment in a VM is required. Google Cloud infrastructure is indicated, but equivalent alternative infrastructure can be used as well. It is important for the deploying organization to consider the identity and access control choices made when configuring the selected services. If pursuing a manual deployment, a convenient sequence is hydra/→auth-server/→participant-datastore/→participant-manager-datastore/→participant-manager/→study-datastore/→response-datastore/→study-builder/→Android/→iOS/.

To deploy the Auth server manually:

1. Create a Compute Engine VM instance with your preferred machine type and OS (for example, e2-medium and Debian 10), then reserve a static IP
2. Verify that your VM instance has the Stackdriver Logging API write access scope (on by default) and that your VM’s service account has the Logs Writer role (off by default)
3. Check out the latest code from the FDA MyStudies repository
4. Create a Cloud SQL instance with MySQL v5.7 (instructions)
5. Configure the Auth server database on the Cloud SQL instance
   • Create a user account that the Auth server application will use to access this instance (instructions)
   • Create a database named oauth_server_hydra with the mystudies_oauth_server_hydra_db_script.sql script (instructions)
   • Enable the database’s private IP connectivity in the same network as your VM (instructions)
6. To enable https, obtain a certificate from a certificate authority or prepare a self-signed certificate
   • For example, if you included the host name of this VM instance in the list of Subject Alternative Names in the certificate that you created during Hydra deployment, you could use openssl pkcs12 -export -password pass:changeit -out mystudies-cert.p12 -inkey <path_to_mystudies-private.key> -in <path_to_mystudies-cert.pem> to convert that certificate for use in this deployment (where mystudies-private.key and mystudies-cert.pem are the certificate files you created during Hydra deployment)
7. Deploy the Auth server container to the VM
   • Create the Docker image using sudo mvn -B package -Pprod com.google.cloud.tools:jib-maven-plugin:2.5.2:dockerBuild -Dimage=auth-server-image from the auth-server/ directory (you may need to install Docker and Maven, for example sudo apt install maven)
   • Update the Docker environment file variables.env with the values of the application.properties file for your deployment
   • Run the container on your VM using sudo docker run --detach -v ~/certs:/certs --env-file variables.env -p 443:8080 --name auth-server auth-server-image (you may need to adjust the port to 80 if you are using http)
   • If your Hydra instance is using a self-signed certificate, add that certificate to your container’s keystore, for example with sudo docker exec -it auth-server bash -c "openssl s_client -connect <your_hydra_instance> | sed -ne '/-BEGIN CERTIFICATE/,/END CERTIFICATE/p' > hydra.crt; keytool -import -trustcacerts -alias hydra -file hydra.crt -keystore /usr/local/openjdk-11/lib/security/cacerts -storepass changeit", then restart the container with sudo docker restart auth-server
8. Test if the application is running with curl -k https://0.0.0.0/auth-server/healthCheck
9. You can review application logs in the logging directory you specified, or with sudo docker logs auth-server; audit logs are available in Cloud Logging

---

Copyright 2020 Google LLC