Merge pull request #3045 from edx/clintonb/ida-jwt-update

Updated JWT configuration for IDAs 

playbooks/roles/credentials/defaults/main.yml

@@ -71,13 +71,13 @@ CREDENTIALS_PROGRAMS_API_JWT_SECRET_KEY: 'SET-ME-TO-THE-SAME-AS-PROGRAMS_SOCIAL_
 
 # Absolute URL used to get organization data from the organizations api in LMS
 CREDENTIALS_ORGANIZATIONS_API_URL: 'https://127.0.0.1:8000/api/organizations/v0/'
-CREDENTIALS_ORGANIZATIONS_API_AUDIENCE: 'SET-ME-TO-THE-SAME-AS-EDXAPP_JWT_AUDIENCE'
-CREDENTIALS_ORGANIZATIONS_API_SECRET_KEY: 'SET-ME-TO-THE-SAME-AS-EDXAPP_JWT_SECRET_KEY'
+CREDENTIALS_ORGANIZATIONS_API_AUDIENCE: '{{ EDXAPP_JWT_AUDIENCE | default("lms-key") }}'
+CREDENTIALS_ORGANIZATIONS_API_SECRET_KEY: '{{ EDXAPP_JWT_SECRET_KEY | default("lms-secret") }}'
 
 # Absolute URL used to get user data from the user api in LMS
 CREDENTIALS_USER_API_URL: 'https://127.0.0.1:8000/api/user/v1/'
-CREDENTIALS_USER_API_JWT_AUDIENCE: 'SET-ME-TO-THE-SAME-AS-EDXAPP_JWT_AUDIENCE'
-CREDENTIALS_USER_API_JWT_SECRET_KEY: 'SET-ME-TO-THE-SAME-AS-EDXAPP_JWT_SECRET_KEY'
+CREDENTIALS_USER_API_JWT_AUDIENCE: '{{ EDXAPP_JWT_AUDIENCE | default("lms-key") }}'
+CREDENTIALS_USER_API_JWT_SECRET_KEY: '{{ EDXAPP_JWT_SECRET_KEY | default("lms-secret") }}'
 
 CREDENTIALS_DATA_DIR: '{{ COMMON_DATA_DIR }}/{{ credentials_service_name }}'
 CREDENTIALS_MEDIA_ROOT: '{{ CREDENTIALS_DATA_DIR }}/media'

playbooks/roles/discovery/defaults/main.yml

@@ -61,7 +61,7 @@ DISCOVERY_EDX_DRF_EXTENSIONS:
 
 DISCOVERY_JWT_AUDIENCE: '{{ EDXAPP_JWT_AUDIENCE | default("SET-ME-PLEASE") }}'
 DISCOVERY_JWT_ISSUER: '{{ DISCOVERY_OAUTH_URL_ROOT }}'
-DISCOVERY_JWT_SECRET_KEY: '{{ EDXAPP_JWT_SECRET_KEY | default("SET-ME-PLEASE") }}'
+DISCOVERY_JWT_SECRET_KEY: '{{ EDXAPP_JWT_SECRET_KEY | default("lms-secret") }}'
 
 
 DISCOVERY_SECRET_KEY: 'Your secret key here'

playbooks/roles/ecommerce/defaults/main.yml

@@ -43,7 +43,7 @@ ECOMMERCE_LANGUAGE_CODE: 'en-us'
 ECOMMERCE_EDX_API_KEY: 'PUT_YOUR_API_KEY_HERE'  # This should match the value set for edxapp
 ECOMMERCE_ECOMMERCE_URL_ROOT: 'http://localhost:8002'
 ECOMMERCE_LMS_URL_ROOT: 'http://127.0.0.1:8000'
-ECOMMERCE_JWT_SECRET_KEY: 'SET-ME-PLEASE'  # This should match the value set for edxapp
+ECOMMERCE_JWT_SECRET_KEY: '{{ EDXAPP_JWT_SECRET_KEY | default("lms-secret") }}'
 ECOMMERCE_JWT_ALGORITHM: 'HS256'
 ECOMMERCE_JWT_VERIFY_EXPIRATION: true
 ECOMMERCE_JWT_DECODE_HANDLER: 'ecommerce.extensions.api.handlers.jwt_decode_handler'
@@ -51,6 +51,12 @@ ECOMMERCE_JWT_ISSUERS:
   - '{{ ECOMMERCE_LMS_URL_ROOT }}/oauth2'
   - 'ecommerce_worker'  # Must match the value of JWT_ISSUER configured for the ecommerce worker.
 
+# NOTE: We have an array of keys to allow for support of multiple when, for example,
+# we change keys. This will ensure we continue to operate with JWTs issued signed with the old key
+# while migrating to the new key.
+ECOMMERCE_JWT_SECRET_KEYS:
+  - ECOMMERCE_JWT_SECRET_KEY
+
 # Used to automatically configure OAuth2 Client
 ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_KEY : 'ecommerce-key'
 ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_SECRET : 'ecommerce-secret'
@@ -141,6 +147,7 @@ ECOMMERCE_SERVICE_CONFIG:
     JWT_LEEWAY: 1
     JWT_DECODE_HANDLER: '{{ ECOMMERCE_JWT_DECODE_HANDLER }}'
     JWT_ISSUERS: '{{ ECOMMERCE_JWT_ISSUERS }}'
+    JWT_SECRET_KEYS: '{{ ECOMMERCE_JWT_SECRET_KEYS }}'
   SOCIAL_AUTH_EDX_OIDC_KEY: '{{ ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_KEY }}'
   SOCIAL_AUTH_EDX_OIDC_SECRET: '{{ ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_SECRET }}'
   SOCIAL_AUTH_EDX_OIDC_ID_TOKEN_DECRYPTION_KEY: '{{ ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_SECRET }}'

playbooks/roles/edxapp/defaults/main.yml

@@ -503,7 +503,8 @@ PERFORMANCE_GRAPHITE_URL: 'SetPerformanceGraphiteHostName'
 # E-Commerce Related Settings
 EDXAPP_ECOMMERCE_PUBLIC_URL_ROOT: "http://localhost:8002"
 EDXAPP_ECOMMERCE_API_URL: "http://localhost:8002/api/v2"
-EDXAPP_ECOMMERCE_API_SIGNING_KEY: 'SET-ME-PLEASE'
+# TODO (CCB) Remove this after all references in edx/edx-platform have been removed.
+EDXAPP_ECOMMERCE_API_SIGNING_KEY: "{{ EDXAPP_JWT_SECRET_KEY }}"
 
 # Mailchimp Settings
 EDXAPP_MAILCHIMP_NEW_USER_LIST_ID: null