feat: #1179 bceid login

[MCatherine1994]

refs: #1179

• Support business bceid login in FAM, use TEST-BUSINESSBCEID for local and dev environment, as we don't have any DEV business bceid for testing and playing around. To keep consistency we use TEST-IDIR for local and dev environment as well, so the same logout chain could work for both. Update the backend local cognito user id to use "test-idir", update backend test to use "test-idir" as well
• Update the profile to display more information

• Admin management endpoint get_admin_user_access doesn't need to check access group in the token, delegated admin won't have any access in the token. That API will return the access for the login user. Created a new router guard method to return requester data without check the access role in the token

[basilv]

@MCatherine1994 I didn't understand your comment "Note: Our logout chain in local and dev connects with the dev environment, so the logout for test business bceid will only log the user out from Cognito but still have the sitemider session. " - why wouldn't local/dev logout chain be configured for the test business BCeID environment? Is that because the dev keycloak instance is only pointing at dev BCeID, not test?

[MCatherine1994]

@MCatherine1994 I didn't understand your comment "Note: Our logout chain in local and dev connects with the dev environment, so the logout for test business bceid will only log the user out from Cognito but still have the sitemider session. " - why wouldn't local/dev logout chain be configured for the test business BCeID environment? Is that because the dev keycloak instance is only pointing at dev BCeID, not test?

Hi Basil, that's just because for our local/dev environment, we suppose to use DEV-IDIR and DEV-BUSINESS-BCEID, and they work with the same DEV logout chain. But because we don't have dev bceid for testing, I setup to use DEV-IDIR and TEST-BUSINESS-BCEID for local/dev environment. So DEV-IDIR needs dev logout chain, but TEST-BUSINESS-BCEID needs test logout chain.
The Amplify just configured with one redirect logout url doesn't support both in the current code. And I feel it's fine so I didn't change the Amplify config. Because for TEST env, IDIR and BCEID will both connect with TEST, and same for PROD. So the issue is only in DEV.
Now I'm thinking maybe we can just use TEST-IDIR and TEST-BUSINESS-BCEID for local and dev, and config the test logout chain, so logout can work properly for both. And use DEV orTEST IDIR won't impact the login behaviour?

[basilv]

@MCatherine1994 I didn't understand your comment "Note: Our logout chain in local and dev connects with the dev environment, so the logout for test business bceid will only log the user out from Cognito but still have the sitemider session. " - why wouldn't local/dev logout chain be configured for the test business BCeID environment? Is that because the dev keycloak instance is only pointing at dev BCeID, not test?

Hi Basil, that's just because for our local/dev environment, we suppose to use DEV-IDIR and DEV-BUSINESS-BCEID, and they work with the same DEV logout chain. But because we don't have dev bceid for testing, I setup to use DEV-IDIR and TEST-BUSINESS-BCEID for local/dev environment. So DEV-IDIR needs dev logout chain, but TEST-BUSINESS-BCEID needs test logout chain. The Amplify just configured with one redirect logout url doesn't support both in the current code. And I feel it's fine so I didn't change the Amplify config. Because for TEST env, IDIR and BCEID will both connect with TEST, and same for PROD. So the issue is only in DEV. Now I'm thinking maybe we can just use TEST-IDIR and TEST-BUSINESS-BCEID for local and dev, and config the test logout chain, so logout can work properly for both. And use DEV orTEST IDIR won't impact the login behaviour?

This makes sense, just as long as this is documented somewhere in the dev configuration.

[sonarcloud]

Quality Gate passed for 'nr-forests-access-management_admin'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
85.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud