Distinguishing between national and local T7 CDA deployments

[adamkorynta]

The CAVI is looking to add a feature that converts JDBC/Oracle extract groups to CDA extract groups. One of the interface options could be to convert to a national or local instance of CDA. On top of that it would be useful to be able to convert a local instance CDA to a national one. This brings up the question of how to determine national vs local.

Some options in order of most to least robust:

• CDA can add a national vs local flag to an endpoint. The authenticated version endpoint seems like a good candidate Add endpoint for CDA software version that requires auth #594
• The client can look at the context and determine cwms-data means national, otherwise local
• The client can compare against hard-coded URL strings against CWBI/DMZ URL's

[MikeNeilson]

There's a forth option for this that may be more appropriate. The context definitely determines if district or national but if you're looking for can I authenticate the best solution is to look at the Security Schemes defined in the open api definition.

Though I did just realize the current national instance is incorrect as it lists CWMS AAA when it should list none, but that I think is the correct solution for determine the level of access. Per instance the Security Schemes should be defined correctly.

I was planning to correct some of our design decisions about the AccessManager when I get back and can address the actual API output at that time.

[MikeNeilson]

Ah, I see. I don't disagree with #594, and the primary security concern is "dealing with stupid VPD reports once a week at likely a minimum" not actual security.

[adamkorynta]

I don't like the idea of parsing the swagger docs over parsing the URL because... well we already see that it wouldn't work correctly. I also don't see any other use case of wanting to parse through swagger docs at the moment at runtime. The "cwms-data" context would be easier as long as that is consistently replaced by "-data" at every non-national instance.

[MikeNeilson]

For the context it's always (in regex format):

(district|cwms)-data(-.*)?

Where district is a district or division name and cwms is the literal text "cwms" which indicates national. And the bit at the end is so multiple versions can be used on the same host and is arbitrary text.

If a given system is setup in a way to contradict this design choice it is invalid and we have no practical way to protect against it.

As for the swagger docs not parsing well at runtime... we really need to fix that, but I agree for this particular need not necessary. Would be useful for the setup dialog to present the correct login choices though, One of the design intentions is to support OpenID Connect generically which means there could be more than one openid endpoint, but that's beyond the scope of this discussion.

[adamkorynta]

Oh that's a good point about choosing authentication. Swagger does have a java parser library: https://github.com/swagger-api/swagger-parser with an enum for auth types: https://github.com/swagger-api/swagger-core/blob/master/modules/swagger-models/src/main/java/io/swagger/v3/oas/models/security/SecurityScheme.java#L16

[MikeNeilson]

One slight caveat, my apikey token schema doesn't match, hence why we need to manually put the apikey word in when using the swagger-ui. Apparently I didn't read the spec fully between swagger/openapi/http when I decided on that name.