LG-11962 return 406 if biometric selected in production

[jmax-gsa]

🎫 Ticket

LG-11962

🛠 Summary of changes

Added a check to ensure that SP requests for selfies are not permitted in production. This is a temporary measure, until we are actually ready to handle them properly.

📜 Testing Plan

Provide a checklist of steps to confirm the changes.

• Start the Sinatra sample SP and the IDP server.
• From the Sinatra sample SP, request authentication with biometrics. Verify that you end up on the login.gov start page.
• Edit feature_management to simulate a production environment (see below).
• From the Sinatra sample SP, request authentication without biometrics. Verify that you end up on the login.gov start page.
• From the Sinatra sample SP, request authentication with biometrics. Verify that you end up on the 406 page.

Simulating a production environment on a dev box turned out to be a time sink. After spending Friday afternoon shaving yaks, re-assessed and simulated a production environment via a code change. If desired, we could spin up a sandbox for closer simulation of production. I don't feel that's necessary for code review, but perhaps for acceptance.

The code change is in lib/feature_management.rb, lines 167-168:

  def self.idv_block_biometrics_requests?
    # (Identity::Hostdata.in_datacenter? && Identity::Hostdata.env == 'prod') ||
    #   !IdentityConfig.store.doc_auth_selfie_capture_enabled
    true
  end

👀 Screenshots

If relevant, include a screenshot or screen capture of the changes.

Development request for biometrics:

Production: no request for biometrics

Production: request for biometrics

Details

[jmax-gsa]

As an alternative, I could've re-used the existing 404 content and rendered it if necessary, but adding an explicit route to the existing controller and redirecting to it seemed like the better alternative to me. Arguments to the contrary invited.

[soniaconnolly]

LGTM. I like the way the check for prod is set up now. We might want to add the datacenter check to decorated_session.selfie_required? (but not in this PR).