Updated the workflow to publish Docker images to Amazon ECR instead of a
Docker repository. Added AWS credentials configuration, ECR repository
creation, and image tag immutability enforcement.
<!--- Provide a general summary of your changes in the Title above -->
## Description
<!--- Describe your changes in detail -->
## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->
## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->
- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
Updated the workflow to publish Docker images to Amazon ECR instead of a Docker repository. Added AWS credentials configuration, ECR repository creation, and image tag immutability enforcement.
<!--- Provide a general summary of your changes in the Title above -->
## Description
Enhance audit logging by including request details and IP addresses in
audit entries
## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->
## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->
- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
## Description
During logout all sessions, the session should be removed from Redis,
otherwise even though the token is expired (cannot write), the user can
still read data in the application while the session (15 minutes of
refresh token) is still valid
for that we are mapping all session keys to a new entry (encrypted) in
Redis based on user information and the secret
after logout all sessions, we remove the current session from Redis
(already existing mechanism), and also read this entry to remove all
other active sessions
## Motivation and Context
AB#1625768
## How Has This Been Tested?
Locally with pics
## Checklist:
- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [x] I have created a feature (non-master) branch for my PR.
- [x] Do not stop flow if revoke fails.
- [x] Properly handle/log error
## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->
## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->
- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
Adding functionality to revoke access token on logout. This will use the
newly added OAUTH2_PROXY_BACKEND_REVOKE_ACCESS_TOKEN_URL environment
variable.
AB#1624642
## Motivation and Context
Adding the functionality to revoke an access token on logout prevents an
attacker from continuing to use a stolen access token until the
expiration of the TTL.
## How Has This Been Tested?
Running it locally integrated with Pics.
<!--- Provide a general summary of your changes in the Title above -->
## Description
Change the audit code from 110123 to 110114.
## Motivation and Context
The code 110123 was not present and know by the audit log server.
after running `cf logs oauth_proxy --recent` in the
pics_client_test_us_east we saw this error:
`2025-01-14T11:06:04.64+0100 [APP/PROC/WEB/0] ERR 2025/01/14 10:06:04
Not able to send the audit message
{"issue":[{"severity":"error","code":"invalid","details":{"coding":[{"system":"https://www.hl7.org/fhir/valueset-operation-outcome.html","code":"MSG_ERROR_PARSING"}],"text":"Not
complaint with AuditEvent specification"},"diagnostics":"Not complaint
with AuditEvent specification"}],"resourceType":"OperationOutcome"}`
Unfortunately there is no error message logged in Kibana.
## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->
## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->
- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
## Description
- [x] Adding audit log to logout all sessions
- [x] Updating variable name
AB#1437807
## Motivation and Context
Audit log for logout all sessions
## How Has This Been Tested?
Locally integrated with PICS. Used webhook to receive the audit entry.
## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->
- [x] My change requires a change to the documentation or CHANGELOG.
- [x] I have updated the documentation/CHANGELOG accordingly.
- [x] I have created a feature (non-master) branch for my PR.
Sailinder Harpal
Danilo Mendes Rocha
Danilo Mendes Rocha
Eduardo Vozniak
Felipe Fey
Anderson Valério
Anderson Valério
Harpal, Sailinder
Joana Deluca Kleis
Joana Deluca Kleis