#5799 Use custom idp token for enterprise server authentication if special jwt is stored in local store

[ioanmo226]

This PR implemented functionality to use custom idp token for enterprise server authentication if special jwt is stored in local store

close #5799 // if this PR closes an issue

---

Tests (delete all except exactly one):

• Tests added or updated

---

To be filled by reviewers

I have reviewed that this PR... (tick whichever items you personally focused on during this review):

• addresses the issue it closes (if any)
• code is readable and understandable
• is accompanied with tests, or tests are not needed
• is free of vulnerabilities
• is documented clearly and usefully, or doesn't need documentation

[ioanmo226]

@sosnovsky Custom IDP id_token is now also used in EKM.
Please check.

[ioanmo226]

By the way, are fes/ekm apis ready to accept custom idp id_tokens instead of google id_token?

[sosnovsky]

By the way, are fes/ekm apis ready to accept custom idp id_tokens instead of google id_token?

It's possible to configure custom IdP in Enterprise Service, but our documentation mentions that only Google is supported for end-users (https://flowcrypt.com/docs/technical/enterprise/configuration/authentication.html). Need to check if it works with custom IdP or some changes are needed for Enterprise Server too

[sosnovsky]

Works great! I was able to test setup with local FES and Auth0 IdP 🚀

[sosnovsky]

Well done 👍

[ioanmo226]

@sosnovsky Have you checked FES side if it's ready to accept custom IDP id_tokens?

[ioanmo226]

How do you plan to support it?
You know once we publish this version, new version users would submit custom IDP id_tokens to FES/EKM. and old version users would submit google id_tokens to fes/ekm.
Is fes and ekm ready to accept both?

[sosnovsky]

I configured custom IdP (Auth0) in local Enterprise Server and tested EKM requests (for saving and retrieving private key) - they work well.

You know once we publish this version, new version users would submit custom IDP id_tokens to FES/EKM. and old version users would submit google id_tokens to fes/ekm.

Custom IdP id tokens will be used only by new customers who will have IdP configuration, our existing customers will continue to use Google id tokens, this change shouldn't affect them.

In ES configuration we set properties for user IdP (by default it's Google IdP) (https://flowcrypt.com/docs/technical/enterprise/configuration/authentication.html#end-user-properties-for-fes-and-ekm), so depending on this configuration properties ES will know which IdP should be used for verifying received tokens.

[ioanmo226]

Aha, I see
Thank you for your clarification