handle service account key expiration in all cases

2.5.10

fix(sa-expiration): actually expire user-issued keys, even if there a…

fix jwt keys ordering

Merge pull request #551 from uc-cdis/fix/key-order

fix(key-order): use basename

remove duplicated black list logic

Merge pull request #550 from uc-cdis/fix/key-order

fix(key-order): order of JWT keypairs

patch to keep same behavior for refresh token

Merge pull request #548 from uc-cdis/fix/refresh-tokens

fix(refresh): don't provide new refresh token when hitting token endp…

Fix bug when refreshing tokens

Fix issue that when scope is provided for refreshing access_tokens an exception in raised

Bug fix for case insensitive handling during usersync

Fixes issue with different case b/t dbgap and user.yaml causing exception

Bug fixes: Google endpoints/error handling & user syncing

2.5.4

fix(bugs): fix cfg handling so google client exists for dcf, fix new …

fix logging in fence-create

by default let fence-create log everything down to INFO

no Google+ API calls

We use Google+ API for /login/google and “On March 7, 2019, all Google+ APIs and Google+ Sign-in will be shut down completely. This will be a progressive shutdown beginning in late January, with calls to these APIs starting to intermittently fail as early as January 28, 2019.” Therefore, we should update to use google identity instead of Google+.

data upload

Support for new data upload flow.

Some major deployment changes:

• Fence configuration for data upload requires DATA_UPLOAD_BUCKET and S3 creds in fence config
• user.yaml format for RBAC is changed; old resources block is still supported, but the proper way to organize the yaml file for user privileges is changed, and looks like this:

rbac:
  policies:
    - id: 'data_upload'
      description: 'upload raw data files to S3'
      role_ids: ['file_uploader']
      resource_paths: ['/data_file']
  resources:
    - name: 'data_file'
    - name: 'programs'
      subresources:
      - name: 'test'
        subresources:
        - name: 'projects'
          subresources:
          - name: 'test'
      - name: 'test_program'
  roles:
    - id: 'file_uploader'
      description: 'can upload data files'
      permissions:
        - id: 'file_upload'
          action:
            service: 'fence'
            method: 'file_upload'

To grant users access for uploading data files, they need the corresponding data_upload policy added:

users:
  example_user@domain.com:
    policies: ['data_upload']