SMAC: FastAPI Auth

This project contains the reusable code for authentication in Python backends using FastAPI. It leverages Cognito User Pools and Secrets Manager for authentication.

Usage

TBD

Authentication of Service Principals (Automation)

The authentication of service principals is done leveraging AWS Secrets Manager. The service principal needs to provide a token that and an identifier. The name identifier is used to retrieve the secret from Secrets Manager. The token is validated against the secret. The secret in Secrets Manager needs to be a JSON object with the following structure:

{
  "token": "Secret Token",
  "id": "Actual principal identifier of the service"
}

Configuration (Environment Variables)

Configuration is done through environment variables. The following table lists the environment variables that can be used to configure the authentication.

Note: The secondary user pool is entirely optional. If it is configured, keep in mind that the SMAC__AUTH__USER_ID cannot be set to sub as the user pools create the sub claim automatically. It is advised to use the email address as the user identifier in this case so that the application logic does not need to differentiate between the primary and secondary user pools.

Development

Setup

1. Install Poetry

2. Install dependencies:

   poetry config virtualenvs.in-project true
   poetry install --with dev
   
   # Install pre-commit hooks
   poetry run pre-commit install
   

3. Run tests:

   poetry run pytest --cov .
   

Releases

Releases are done automatically using python-semantic-release.

Refer to the CHANGELOG for the release history.

Note that minor releases are done, if the underlying fastapi version changes. This is to ensure that the package is compatible with the latest fastapi version and to address any security vulnerabilities.