Auth Consolidation & User Management Review

[bsatoriu]

What's New on UAT — Auth Modernization & User Management (July 2026)

Informal testing guide for the internal team. Everything below is live on UAT.
Please run through your areas and drop findings below.

Test environments

Surface	URL
Website / sign-up	https://uat.maap-project.org · https://uat.maap-project.org/signup
Hub	https://staging.hub.maap-project.org
Console	https://console.uat.maap-project.org
API	https://api.uat.maap-project.org
Keycloak (admins)	https://keycloak.delta-backend.xyz (realm maap)

The big picture: the legacy CAS SSO is gone from UAT except for the legacy ADE client. Every surface —
website, Hub, Console — now authenticates through the same Keycloak → Earthdata
Login flow, new users are registered automatically on first touch, and user
approval (status, role, orgs, Hub groups) is now a single form in the Console.

---

1. CAS → Keycloak → Earthdata Login (website login)

What changed: uat.maap-project.org no longer uses CAS (authorizer plugin
deactivated). WordPress logs in via Keycloak, which goes straight to Earthdata
Login. The MAAP API is called with Keycloak tokens instead of CAS proxy
tickets — all the existing cookie/header plumbing is unchanged underneath.

Test: click Login on uat.maap-project.org →

• You should land directly on the EDL sign-in (no Keycloak login page, no CAS
  page anywhere).
• Existing EDL account works with no re-registration — and if you had a
  CAS-era WordPress account, it should link to the same WP user (no duplicate).
• After login: /profile/ renders your member info with account service
  "Earthdata Login (URS)"; SSH key upload/delete works.
• Log out of WP → both wp_maap_pgt and wp_maap_client_name cookies cleared.

Watch for: duplicate WP users after login (would mean account linking
failed); profile page showing "Log back in" right after a login (cookie
minting issue).

2. Automatic per-user EDL token refresh

What changed: the API now maintains a per-user EDL (URS) token: bootstrapped
from Keycloak's EDL broker at login, then refreshed directly against Earthdata
using a stored refresh token. This is what powers federated data access
(granule downloads, S3 credentials) without the old shared-account hacks.

Test: log into the Hub fresh →

• Generate S3 credentials / access the workspace bucket.
• Download a granule through the API's federated request path (e.g. via
  maap-py downloadGranule on an EDL-protected URL).
• Both should work on a brand-new login (proves the broker bootstrap) and
  again the next day (proves the refresh path, no re-login).

Watch for: any 500 errors when calling these protected endpoints.

3. Automatic member creation on first login

What changed: the API auto-creates a MAAP member record the first time any
Keycloak-authenticated user touches it — from any entry point (website, Hub,
Console). New members are created as Guest / suspended ("pending review");
pre-approved email addresses come in as active. This replaces the
registration step CAS used to provide.

Test: register a fresh EDL test account → log in anywhere on UAT →

• Console → Admin → Users: the new account appears within seconds, status
  suspended, role Guest.
• /profile/ on the website shows "Pending Activation" for that user.
• A pre-approved email (Admin → Pre-Approved) auto-creates as active.

Watch for: duplicate member rows (there's a uniqueness guard — flag if you
ever see two); no emails should be sent by the API (see call-outs below).

4. New sign-up page + "in queue" redirects

What changed: a universal sign-up page at uat.maap-project.org/signup
(current-site styling, temporary until the v2 site redesign). It has two
states: fresh-visitor ("Request access" + 3 steps) and post-registration
("You're in the queue", ?status=pending). Unapproved users are funneled to it
from every surface.

Test: with your new, unapproved account:

• Visit the Hub → EDL sign-in → you should land on
  uat.maap-project.org/signup?status=pending&from=hub — the "You're in the
  queue" state (steps 1–2 checked, no sign-in button).
• Visit the Console → same pending redirect (from=console).
• Re-visiting the Hub while unapproved loops you back to the pending page —
  never a bare /signup, never a dead-end 403 page.
• As a fresh visitor (incognito, no session): /signup shows the "Get started
  with Earthdata Login" state; the button starts the EDL flow.

Watch for: landing on /signup without the ?status=pending query after
authenticating (that's a redirect regression); the old "Thank you for
registering / stand by" static pages should be gone everywhere.

5. Console: Review User (single-form approval)

What changed: in Console → Admin → Users, the username is now a link that
opens a Review User modal combining everything approval needs:

• Status (activate/suspend) and Role (Guest/Member/Admin)
• Organizations — searchable picker with hierarchy indentation, assigned
  orgs listed with × remove
• Hub Groups — live from Keycloak, editable; Save writes group membership
  back (this is what used to require the Keycloak admin console)

Also on the Users list: new Email column, click-to-sort on every
column, and the old Actions column is gone (status changes now happen in the
modal).

Test: approve your test user end-to-end from the Console alone:

1. Open the modal → set Status Active, assign an org, check
   JupyterHub MAAP User → Save.
2. Log in as that user on the Hub → workspace access works. That's the full
   approval without ever opening Keycloak.
3. Suspend flow: set Status Suspended → note the warning → Save →
   verify in Keycloak that ALL the user's JupyterHub groups were removed
   (real revocation). ⚠️ Re-activating does NOT restore groups — you must
   re-assign them. This is by design; make sure the warning copy makes that
   clear enough.
4. Partial-failure: if any save step fails, the modal stays open with a red
   banner listing exactly what failed — nothing fails silently.

Watch for: "Hub groups unavailable" notes (Keycloak service-account
issue — the rest of the modal still works by design); non-operators being able
to reach /admin/users or the group endpoints (they should get 403s).

6. Personal Access Tokens (NASA + ESA)

What changed: the API's gateway endpoints mint long-lived PATs, replacing
MAAP_PGT for programmatic use outside the Hub. PATs are tied to your member
account (must be active) and honor role enforcement.

Test:

• Create a PAT: Console → Profile → Personal Access Tokens → create; copy the
  token (shown once).
• Outside the Hub, point maap-py at UAT and use the PAT in place of the old
  MAAP_PGT value — searches, job submission, and granule access should work.
• Revoke the token in the Console → the same calls should start failing.
• ESA path: admin-minted tokens via the gateway admin endpoints (X-MAAP-Admin
  headers) — ESA folks should verify their integration mints and uses tokens
  successfully.

Watch for: a PAT belonging to a suspended member should NOT work
(status is enforced on the PAT path).

---

Other call-outs

A. All API email notifications are OFF. The Hub environment is now the
single source of user communication (registration + activation emails). The
API's templates were stale, so its sends are disabled behind a flag
(MEMBER_EMAIL_NOTIFICATIONS_ENABLED=false). → When testing registration and
activation, expect Hub-sent emails only, exactly one of each — report both
missing emails AND duplicates.

B. Hub/Console login UX is now uniform. Visiting either with no session
goes straight to EDL — no intermediate login pages. The signup landing page
is only reachable by navigating to /signup directly (e.g. from the website's
Get Started button, which hides when you're logged in).