External api to generate Auth Token for API users

[mahalakshme]

Need:

Not all backend languages support SRP. So, some prefer user-password authentication. For this, sharing AWS access keys outside our org is not safe. So we need a login API.

AC:

• Create an api which accepts username and password and does SRP authentication with Cognito and returns an access token
• This login API should work only when a user is marked as API user. This can be tracked by 'Should Allow Api Login' field in settings column of users table.
• The above flag can be added in UI under Settings

Technical details:

Code in this file in integration repo can be reused. Looks like fetching refresh token is not done, and each time we fetch access token only, same can be done.

Inputs:

isApiUser - login via API
timeout - low one is good -

[himeshr]

Himesh's Review comments:

• How would we perform access control in code to restrict the actions performed by the apiUser.?
• We make use of Privileges to restrict API access, so how would we tie up the API user flag with the Privilege.?

[himeshr]

@mahalakshme is this api to be considered external api, and swagger api doc entry needed for it.? Or do we hide it to prevent abuse?

[himeshr]

Screenshots of web user setting and API invocation:

[himeshr]

Test cases

Webapp

• Create / edit user to enable / disable token generation setting

Server

• Invoke Token generate api with isAllowedToInvokeTokenGenerationAPI enabled
• • Invalid username (should fail)
• • valid username , invalid password (should fail)
• • valid username and password (pass)
• Invoke Token generate api with isAllowedToInvokeTokenGenerationAPI disabled
• • valid username and password (should fail)
• Generated token should be working for any get external api invocation (ex: get subjects)
• Token generation api should work for both Keycloak / Cognito using organisations
• UsersAndCatchments CSV should also support enable / disable of isAllowedToInvokeTokenGenerationAPI settings for Users
• Do not support isAllowedToInvokeTokenGenerationAPI setting in UsersAndCatchments CSV upload