Merge pull request #2137 from edx/nickersoft/jwt-security

XCOM-281: Configuration now includes JWT issuer and expiration date

playbooks/roles/ecommerce/defaults/main.yml

@@ -9,7 +9,7 @@
 #
 ##
 # Defaults for role ecommerce
-# 
+#
 
 ECOMMERCE_GIT_IDENTITY: !!null
 
@@ -42,9 +42,10 @@ ECOMMERCE_EDX_API_KEY: 'put-your-edx-api-auth-token-here'
 ECOMMERCE_ECOMMERCE_URL_ROOT: 'https://www.example.com'
 ECOMMERCE_LMS_URL_ROOT: 'https://www.example.com'
 ECOMMERCE_JWT_SECRET_KEY: 'generated-key-that-matches-ECOMMERCE_API_SIGNING_KEY-in-edxapp'
+ECOMMERCE_JWT_VERIFY_EXPIRATION: true
 
 # Generated by the app that you're using as your auth source
-# in most cases this will be the edx-platform 
+# in most cases this will be the edx-platform
 ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_KEY : 'some-secret'
 ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_SECRET : 'some-secret'
 ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_ID_TOKEN_DECRYPTION_KEY : 'some-secret'
@@ -104,6 +105,8 @@ ECOMMERCE_SERVICE_CONFIG:
   LMS_DASHBOARD_URL: '{{ ECOMMERCE_LMS_URL_ROOT }}/dashboard'
   JWT_AUTH:
     JWT_SECRET_KEY: '{{ ECOMMERCE_JWT_SECRET_KEY }}'
+    JWT_ISSUER: '{{ ECOMMERCE_LMS_URL_ROOT }}/oauth2'
+    JWT_VERIFY_EXPIRATION: '{{ ECOMMERCE_JWT_VERIFY_EXPIRATION }}'
   SOCIAL_AUTH_EDX_OIDC_KEY: '{{ ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_KEY }}'
   SOCIAL_AUTH_EDX_OIDC_SECRET: '{{ ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_SECRET }}'
   SOCIAL_AUTH_EDX_OIDC_ID_TOKEN_DECRYPTION_KEY: '{{ ECOMMERCE_SOCIAL_AUTH_EDX_OIDC_ID_TOKEN_DECRYPTION_KEY }}'
@@ -131,7 +134,7 @@ ECOMMERCE_REPOS:
     DESTINATION: "{{ ecommerce_code_dir }}"
     SSH_KEY: "{{ ECOMMERCE_GIT_IDENTITY }}"
 
-    
+
 ECOMMERCE_GUNICORN_WORKERS: "2"
 ECOMMERCE_GUNICORN_EXTRA: ""
 ECOMMERCE_GUNICORN_EXTRA_CONF: ""

playbooks/roles/edxapp/defaults/main.yml

@@ -229,6 +229,7 @@ EDXAPP_BULK_EMAIL_DEFAULT_FROM_EMAIL: 'no-reply@example.com'
 EDXAPP_BULK_EMAIL_LOG_SENT_EMAILS: false
 EDXAPP_UNIVERSITY_EMAIL: 'university@example.com'
 EDXAPP_PRESS_EMAIL: 'press@example.com'
+EDXAPP_JWT_EXPIRATION: 30  # Number of seconds until expiration
 
 EDXAPP_PLATFORM_TWITTER_ACCOUNT: '@YourPlatformTwitterAccount'
 EDXAPP_PLATFORM_FACEBOOK_ACCOUNT: 'http://www.facebook.com/YourPlatformFacebookAccount'
@@ -717,6 +718,8 @@ generic_env_config:  &edxapp_generic_env
   WIKI_ENABLED: true
   SYSLOG_SERVER:  "{{ EDXAPP_SYSLOG_SERVER }}"
   LOG_DIR:  "{{ COMMON_DATA_DIR }}/logs/edx"
+  JWT_ISSUER: "https://{{ EDXAPP_LMS_BASE }}/oauth2"
+  JWT_EXPIRATION: '{{ EDXAPP_JWT_EXPIRATION }}'
 
   #must end in slash (https://docs.djangoproject.com/en/1.4/ref/settings/#media-url)
   MEDIA_URL:  "{{ EDXAPP_MEDIA_URL }}/"