Authorization strategy and implementation for submissions endpoint

[jalbinson]

User Story

As a sender onboarded to ReportStream, I want to be authorized to hit the submissions endpoint

Description/Use Case

We want to only allow authorized senders to hit the submissions endpoint.

Risks/Impacts/Considerations

A nefarious user could submit false reports which could skew public health data.

Dev Notes

• Look into custom claims block in Okta to see if its easily possible to inject the org name for easy comparison during authorization check
• Reports in send step may contain thousands of items so a single event wont be able to hold all the condition data. One option is to create a "ItemSentEvent" for each ITEM in the report.

Acceptance Criteria

• Decide under which Okta authorization server clients orgs should live
• Scopes and extra claims clearly defined for organizational users
• Authz strategy implemented for submission endpoint (probably @PreAuthorize annotation)
  • Authorize application user to hit submissions endpoint #16183 handles this now
• Come up with approach for authorization in Azure Functions app that does not depend on Spring
• unit tests

[Andrey-Glazkv]

Hey team! Please add your planning poker estimate with Zenhub @adegolier @arnejduranovic @brick-green @david-navapbc @jack-h-wang @jalbinson @JFisk42 @mkalish @thetaurean

[dylansmith-Nava]

Linking some of the prior research here:

• Identity proofing new senders slide deck (a bit prescriptive, but helpful for context)
• General authentication and verification research folder
• Authentication and verification Mural

The general understanding of the research was that verification by Okta to securely log into and use the RS platform =/= "you are who you say you are". That is, you could be verified by Okta but still be a shady organization that we know nothing about. To really know whether an organization is or isn't nefarious, we'd need a level of Identity Proofing which we don't have yet.

So it's important to point out that this ticket would NOT mitigate or reduce the only stated risk.

[jalbinson]

Decisions made in this ticket are documented in the UP SRD under "Authorization Service Software Requirements"

[arnejduranovic]

The SRD this ticket updated will be implemented here: #14601