16815 authz design #17094
16815 authz design #17094
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Manifest Files |
|
Easy access to see how the page looks rendered |
Integration Test Results 60 files 60 suites 43m 34s ⏱️ Results for commit cfbe8ed. ♻️ This comment has been updated with latest results. |
|
|
|
||
| ## Setting up a new user | ||
|
|
||
| In this system, setting up a new user would be quite easy. Create the user in Okta and then add it the required |
There was a problem hiding this comment.
| In this system, setting up a new user would be quite easy. Create the user in Okta and then add it the required | |
| In this system, setting up a new user would be quite easy. Create the user in Okta and then add it to the required |
| } | ||
| ``` | ||
|
|
||
| We will also need to keep these profiles up to date, therefore, we would need some sort of daily job to check that groups |
There was a problem hiding this comment.
I think there may be more thinking to do here when we design this CLI (if we decide to go this way). Perhaps the CLI tool doesn't just update the profiles but we also use it to create/update applications as well (so a more full-featured CLI) and don't do anything in the Okta GUI for applications so as to not confuse things? Does this sound reasonable/plausible?
|
|
||
| ### Spring | ||
|
|
||
| In Spring we can leverage method security. This allows us to write custom predicates in SpEL (Spring expression language) |
There was a problem hiding this comment.
Note that this only applies to Submission microservice at the moment, right?
|
|
||
| | Scope | Actions | Okta Group | | ||
| |-------------|---------------------------------------------------------------|-------------------------| | ||
| | super_admin | Anything! (org membership does not matter) | ReportStream-SuperAdmin | |
There was a problem hiding this comment.
I'm confused about Okta Group as shown here? So a User (or App?) can be a member of these groups and in addition there will be groups for each Sender/Receiver Organization, like "CA_PHD"? If this is correct, can we update the claims example that's lower down to show how/where these groups would appear?
This PR documents a new design for authorizing endpoints in ReportStream.
Linked Issues