search

nwfsc-fram / boatnet

At-Sea Field Data Collection Software Components for Scientific Surveys and Observers
8 stars 5 forks source link

Auth: Add application name to Login/ OpenAPI queries #684

Closed ghost closed 5 years ago

ghost commented 5 years ago

We will need to query against specific applications; this means the user will need to log in and specify an application along with credentials, add this to the JWT

ghost commented 5 years ago

Since the auth server creates CouchDB users + roles, but doesn't have Application Names, thinking about out a way to handle ApexUserAdmin's Application Names in CouchDB in the future.

e.g. user_example has BOATNET_OBSERVER roles ['observer', 'debriefer'] and IFQ roles ['ifq_user']. Which roles do we give them in couchDB? The CouchDB users only have one "roles" property, so a user with 'admin' roles for BOATNET_OBSERVER would have 'admin' role for IFQ. Currently, it will work correctly, since the user logs in and their roles will be updated according to the application name they log in for. Potentially we could set up a CouchDB for each application.

ghost commented 5 years ago

Two thoughts on this: (1) What's driving this need to expose the application name is so an OTS staff user can enter a search term for a potential captain (let's call him bluebeard), and when he types in Bluebeard, it would search ApexUserAdmin, the IFQ application to see if Bluebeard already exists as a user. If so, then we would create a new CouchDB user and link it to that AUA user

(2) The larger thing to consider is that as Obs-Web/OTS moves beyond just supporting Observer efforts, for instance when it supports OLE Declarations, then we would want to be able to touch these other AUA applications as well to understand their available roles to drive the application. Once we get to this stage (thinking this fall/winter), we'll then be moving beyond just an Obs-Web capability to the One Touch capability that we've been discussing.

ghost commented 5 years ago

Makes sense. I've added the application name to the OpenAPI, so we should be good to get going for the future apps. As we build them out, we can tweak it as needed.