Configure Formio JWT Auth so a user logging into DS does not have to relogin to formio app

[StephenOTT]

https://help.form.io/developer/info/sso/

@baddlan can you review and look at what changes are needed to formio configs/docker and report back in this issue.

@mario-digitalstate can you review the link above and work with @baddlan to get sso working with our JWT>

[baddlan]

Based on Formio docs: JWT SSO (Single Sign On) https://help.form.io/developer/info/sso/

We can create new Formio roles or use existing ones (administrator, authenticated, anonymous).

In the Formio Client app, a new authentication route can be created so we can link to it from the SPA with some parameters to identify the current Auth MS user.

The Formio JWT token is to be generated by the Auth MS upon request by the Formio Client. The token must be signed using the secret key provided in Forimo’s backend config file. This means that the secret key must be known to both Formio MS and Auth MS at deployment time. The signature has been tested using HS256 algorithm.

Auth MS should be aware of Formio Roles and their IDs in order to generate the JWT token. Role information can be obtained by calling GET {{appUrl}}/access. See https://documenter.getpostman.com/view/684631/formio-api/2Jvuks#5c5f5b08-8602-b5dd-51ee-15ac8f7116ea

Here is a sample JWT token payload:

{
  "external": true,
  "form": {
    "_id": "58f63b0119e284002a0ec0f0"   <— Admin form ID (in mongodb::forms)
  },
  "user": {
    "_id": "58f63b0119e284002a0ec0fa",   <— Admin user ID (in mongodb::submissions)
    "roles": [
      "58f63b0119e284002a0ec0ec",  <— Role ID, e.g: administrator (in mongodb::roles)
      "58f63b0119e284002a0ec0ed",
      "58f63b0119e284002a0ec0ee"
    ]
  }
}

Notes:

The sample above is slightly different from the one shown in Formio docs (https://help.form.io/developer/info/sso/) which does not require the user -> _id key to be a valid mongodb document identifier. Instead it only uses the term external as its value. When tested, that caused MongoDB to throw the following error: Cast to ObjectId failed for value "external" at path "_id" for model "submission”.

The new Formio Client authentication route must be registered with the FormioAuthProvider during the app configuration step in index.config.js.

An alternative to eliminate the extra step of communication between the new Formio Client authentication route and the Auth MS is to have the Formio JWT token initially available to the SPA (as part of the user login process) which can then pass it as a parameter to the Formio Client.