bcgov / invasivesBC-mussels-iOS

Apache License 2.0
0 stars 4 forks source link

Update INSPECT/LUCY to use Keycloak for managing roles and permissions #281

Closed davidclaveau closed 4 months ago

davidclaveau commented 6 months ago

Describe the task Migrate the permission logic to use Keycloak instead of the INSPECT/LUCY app's internal database user-management setup.

Purpose Currently, changing user roles requires running a script on the LUCY database, or manually updating roles by porting the database. By updating the app to use Keycloak roles, we can align the app's permission setup with other government apps and use the SSO UI to add/remove users and roles with greater ease.

Acceptance Criteria

Additional context

davidclaveau commented 6 months ago

Preliminary changes have been made to the INSPECT app to check the Keycloak JWT - instead of the API call to LUCY - to determine access. The user is only allowed access if they have "admin" or "data-editor" roles in Keycloak. All other users are considered "invalid" and see the "Access Request" screen. User can attempt to login again to see if their role has been updated.

LocalNewsTV commented 6 months ago

Authentication files were cleaned up, user roles are now determined by keycloak.