Implement Support for Maskinporten Supplier Scope delegations

TheTechArch commented 1 year ago

Description

To support the API scope delegations for Maskinporten, we need to implement several functional areas in the access management component.

This is functionally described here https://github.com/Altinn/altinn-authorization/issues/60

Architecture log

14.11.2022 - We will create a separate table for resource delegations to reduce the risk for code in production and to make it easier to adjust
14.11.2022 - We will need to add a separate table to have resource information in access management
14.11.2022 - Resource Registry will call Endpoint and update information about
29.11.2022 Search for API is done in frontend with a simple hit algorithm and OR as default for word. Search all params. Ownedby, title, scope, description. rightdescrition
06.12.2022 Adds language support for owner of the resource in ServiceResource entity
06.12.2022 We do not add versioning for ServiceResource now. If needed, added later
? Implement BFF for Access Management

Needed clarifications

[x] Do we need to have an API with support for the deletion of multiple delegations at once: NO
[ ] Should we support the change of resource ID after going into production with a new resource?
[ ] Should we support the resource type change after going into production with a new resource?

Testing status

[x] Verify Access Management Running in AT
[x] Resource Registry running in AT
[ ] Run migration from SBL to Resource Registry for resource in TT02
[ ]

Tasks

Basic Access Management Component

[x] Create the access management component and set up a repository
[x] Setup Build pipelines #4
[x] Setup deploy pipelines #3
[x] Setup API management for Access Management #120
[x] Possible to authorize on the scope when using a token https://github.com/Altinn/altinn-authorization/issues/165
[x] Define all possible scopes used for relevant API #164
[ ] Define API management products #160
[ ] Scope handling authorization API #164

Security

[x] Authentication implemented for component #2
[x] CSRF protection implemented #144
[x] Add support for resource access configuration on API https://github.com/Altinn/altinn-access-management/issues/174
[x] Add support for maskinporten authentication in JwtCookie package #187

Access Management API

[x] API for listing rights users have for a resource/application #94
[x] API for delegating APP rights used by Altinn 2 platform
[x] API for listing Maskinporten delegations used by Maskinporten #175
[x] API for listing outbound Maskinporten supplier delegations #79
[x] API for listing inbound Maskinporten supplier delegations #122
[x] API for delegating Maskinporten supplier delegations #173
[x] API for revoking Maskinporten supplier delegations
[x] API for profile #50
[x] API for search for delegatable resources by scope #177
[x] API for AuthorizationResources in access management #185
[x] Integrate with HADM
[x] API to update resource metadata in access management #198
[x] API to lookup party #199
[x] Configure Resource Authorization for Access Management end user API https://github.com/Altinn/altinn-access-management/issues/219
[x] Expose party information for reportees in API #224

Access Managment BFF

[x] Create Proxy for Profile
[x] Create Proxy for Register
[x] Create Proxies for Access Management
[x] Set language cookie https://github.com/Altinn/altinn-access-management-frontend/issues/239

Access Management Frontend

[x] Setup Access Management frontend
[x] Define language support (API, storage++)
[x] Implement views
[x] Implement API integration
[x] Build pipeline
[x] Deploy pipeline
[x] Implement profile API integration
[x] Implement authentication refresh
[x] Implement list resources API integration
[x] Implement search for delegations (inbound/outbound)
[x] Implement API integration for revoke delegations

Export/import batch Altinn 2 - Altinn 3

[x] Create export batch job for resources
[x] Create import batch job for resources
[x] Create export/import batch job for delegated Maskinporten scopes

Altinn 2 bridge

[x] Support HADM roles for delegation

Resource Registry Component

[x] API for importing Maskinporten API resources
[x] Define Scopes used for Resource Registry https://github.com/Altinn/altinn-resource-registry/issues/65
[x] API for exposing Policy for a resource https://github.com/Altinn/altinn-resource-registry/issues/35
[x] API for searching for resources with given parameters
[x] Set up authenticating https://github.com/Altinn/altinn-resource-registry/issues/36
[x] Set up authorization and validation of resource https://github.com/Altinn/altinn-resource-registry/issues/43
[x] Integrate with #198 to update resource https://github.com/Altinn/altinn-resource-registry/issues/61
[x] Add language support to owner of resource (competent authority) https://github.com/Altinn/altinn-resource-registry/issues/62

PDP

[x] Add support for resource access management in PDP https://github.com/Altinn/altinn-authorization/issues/32

Altinn 2 API

[x] Add proxy functionality for admin API so it can work as a proxy for the new admin API in Access management
[x] Create strategy and scripts for hiding resources in Altinn 2 for delegation
[ ] Create scripts for deleting delegation in Altinn 2
[x] System resource for maskinporten in Altinn 2 https://dev.azure.com/digdir/Altinn/_workitems/edit/62735
[x] Feature toggle in GUI

Infrastructure

[x] Establish infrastructure for AT21
[x] Establish infrastructure for AT22
[x] Establish Infrastructure for AT23
[x] Establish Infrastructure for AT24
[x] Establish Infrastructure for TT02
[ ] Establish Infrastructure for PROD
[x] Set up CD for AT 21
[x] Set up CD for AT 22
[x] Set up CD for AT 23
[x] Set up CD for AT 24
[ ] Set up CD for TT02
[ ] Set up CD for PROD

joergenb commented 1 year ago

For maskinporten sin del ville det vere gunstig om APIet kunne stolt på multiple issuere (i test). https://ver2.maskinporten.no/ vil ila 2023 erstattast av https://test.maskinporten.no/ . I tillegg kjem me til å bruka https://maskinporten.dev/ som issuer for lokal utvikling.

sivaglen commented 1 year ago

@TheTechArch og @jonkjetiloye - kan vi luke denne epicen?

NureHassen1 commented 10 months ago

N

annerisbakk commented 1 week ago

@TheTechArch Ber deg ta en vurdering av denne. Kan den lukkes, ref at 9 tasks er åpen.

Altinn / altinn-access-management