[DEPR]: django-oauth2-provider (DOP) related tables

[robrap]

Proposal Date

2022-12-08

Target Ticket Acceptance Date

2022-12-23

Earliest Open edX Named Release Without This Functionality

Palm - 2023-04

Rationale

This deprecation is a continuation of https://openedx.atlassian.net/browse/DEPR-47, DEPR for django-oauth2-provider (DOP) and EdXOpenIdConnect. There was some long-tail work around cleaning up some models and db tables that was never completed, and this is to see that work through. Note that DOP was removed in Juniper.

Additionally, the authentication code and database for the Open edX platform is quite confusing. This will help make it much less confusing for legacy deployments, and slightly less confusing for new deployments.

Removal

Models

• ApplicationOrganization (unused since Juniper)

Tables

DOP:

• oauth2_client (third_party_auth_providerapipermissions has a foreign key reference currently)
• oauth2_grant
• oauth2_accesstoken
• oauth2_refreshtoken

DOP Wrapper:

• oauth2_provider_trustedclient (FK reference to oauth2_client)

Third Party Auth:

• third_party_auth_providerapipermissions (FK reference to oauth2_client)

django-oauth-plus (not really a DOP thing, but unused and we can remove it at the same time):

• oauth_provider_consumer
• oauth_provider_nonce
• oauth_provider_scope
• oauth_provider_token

Replacement

DOP was already replaced with DOT. This is just final cleanup.

Deprecation

No response

Migration

• Originally considered a plan for first backing up DOP tables, but since we've been off DOP for so long, this may be wasted effort.
• SQL commands created for clean-up should be documented and shared for all providers.

Additional Info

• This is copied from a ticket written long ago. It may make sense to ensure these tables have been untouched, and that the lists are accurate.
• Note for 2U: We should check with Data Engineering to ensure each table is safe to remove from their perspective.

[robrap]

Related, I found some additional references to DOP that should be cleaned up:

Using the following searches for django-oauth2-provider and edx-django-oauth2-provider, there seems to be some minor clean-up of DOP remaining:

• https://github.com/search?q=org%3Aopenedx+django-oauth2-provider&type=Code
• https://github.com/search?q=org%3Aopenedx+edx-django-oauth2-provider&type=Code

1. Only docs like ADRs should reference DOP. Other docstrings should no longer mention it, because it is just confusing.
2. It's unclear without further research if OAUTH_DELETE_EXPIRED is still used with DOT, and just the comments need to be updated, or if this should also be removed.

[feanil]

2. It's unclear without further research if OAUTH_DELETE_EXPIRED is still used with DOT, and just the comments need to be updated, or if this should also be removed.

It looks like that and the other settings in the common.py section near the mention of edx-django-oauth2-provider are not used with django-oauth-toolkit and are just remnants of the django-oauth2-provider that should be removed.

References:

• https://django-oauth-toolkit.readthedocs.io/en/latest/settings.html
• I did not see them mentioned in any of the rest of the edx codebase except for in configuration where it should also be cleaned up.
  • https://github.com/search?q=org%3Aopenedx%20OAUTH_DELETE_EXPIRED&type=code
  • https://github.com/search?q=org%3Aopenedx+OAUTH_ID_TOKEN_EXPIRATION&type=code
  • https://github.com/search?q=org%3Aopenedx+OAUTH_ENFORCE_SECURE&type=code
  • https://github.com/search?q=org%3Aopenedx+OAUTH_EXPIRE_CONFIDENTIAL_CLIENT_DAYS&type=code
  • https://github.com/search?q=org%3Aopenedx+OAUTH_EXPIRE_PUBLIC_CLIENT_DAYS&type=code

[feanil]

@robrap The models for DOP have been removed, so is the removal of tables just something that needs to be documented via a list of SQL statements that people can run if they want to remove DOP tables? Or did you have something else in mind?

[robrap]

@feanil: I think yes. Something that can help clean up legacy systems to make it less confusing when looking at the DB directly. Orgs can use the script as is, or skip, or modify as needed.

[dianakhuang]

@pdpinch Can we add this list of tables that is safe to drop to the Palm release notes so we can close out this ticket?

[robrap]

For 2U folk, the implementation of this ticket has moved to edx/edx-arch-experiments#331.

[robrap]

@dianakhuang @feanil:

1. In [DEPR]: django-oauth2-provider (DOP) related tables #82 (comment), I noted some additional DOP related references that should be cleaned up.
2. This ticket also recommends a model clean-up for ApplicationOrganization: https://github.com/search?q=repo%3Aopenedx%2Fedx-platform%20ApplicationOrganization&type=code