Repository navigation
CLA for entities - #2968
Open
simonredfern wants to merge 4 commits into
Open
CLA for entities#2968simonredfern wants to merge 4 commits into
simonredfern wants to merge 4 commits into
Conversation
Get User by PROVIDER and USERNAME, Get User by USER_ID and Get Users are now UserXORApplication: an application acting as itself with the Scope CanGetAnyUser can look users up (e.g. an identity provider), as well as a person with the Entitlement. A person calling through the Consumer does not get its Scope. Their handlers no longer insist on a logged-in User; the access check decides. Anonymous calls now get 401 OBP-20200, as on other UserXORApplication endpoints. Tests: UserLookupApplicationAccessTest; anonymous expectations updated in GetUsersTest, GetUserByUserIdTest and v5.1.0 UserTest.
its values UserOnly, ApplicationOnly, UserXORApplication and UserAndApplication. Who is acting on a request now decides where a Role comes from, the same way on every endpoint. A person needs the Role as an Entitlement. An application acting as itself needs it as a Scope on its Consumer. An application acts as itself only if its Consumer is a Platform App, and it calls with no user or as its own client-credentials user. Keycloak service-account tokens now get such a user too, with provider keycloak#client, named after the client id. Without the Platform App mark, a Consumer's Scopes only work as a limit on people. Operators must mark the applications that act as themselves, such as the Portal, API Manager, Cohort, Sentinel and Bank-Node. handleAccessControlRegardingEntitlementsAndScopes is now the only access check. The middleware, inline Role checks in handlers, Dynamic Entities, Files and the gRPC streams all use it. Consumer Account Access now works on every endpoint of the granted view. Who may call an endpoint is read from its error list only. "User not logged in" or a Role means a user is required. "The application cannot be identified" without it means an identified application is enough, and a user is optional. The 22 Berlin Group and UK Open Banking consent and payment endpoints now say this. An anonymous call to an endpoint with a Role gets OBP-20001 again, not OBP-20200. Dynamic Entities: auth_mode is removed from the v6.0.0 and v7.0.0 definitions and is no longer stored. A client that still sends it is not refused, because the field is ignored. The old column stays in existing databases, unused. An entity's data endpoints work like static endpoints with a Role. v7.0.0 Get My Role returns allowed, true or false, in place of allowed_for_auth_modes. Consumer grant types now only control how tokens can be obtained through a Consumer. They no longer decide whether a call is the application acting as itself. The glossary item Consumer Grant Types is rewritten in plain English, and says what it means to log in through a Consumer. Glossary: API.Entitlements and Scopes replaces API.Endpoint Auth Modes. A new item, OAuth Standards and OBP, lists the OAuth standards OBP works with. The introductory documentation, sample.props.template and the release notes are updated to match. The note todo/todo_remove_endpoint_auth_mode.md records the decisions behind this change. Tests: EndpointAccessRuleTest replaces EndpointAuthModeTest. The new UserOptionalHandlerTest fails if a handler whose doc needs only an identified application insists on a user. DynamicEntityAuthModeTest checks that auth_mode is ignored. Tests of anonymous calls expect OBP-20001. The test applications are marked as Platform Apps. The failure sweep now covers the former UserXORApplication endpoints, and accepts the 503 of Send Email to Customer when no From address is set.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.