RADAR-base/RADAR-Appserver

Add security using Management Portal

Closed this issue · 7 comments

yatharthranjan commented

Add this app-server as a resource in MP and add security here like the Rest-Api does

yatharthranjan commented

Or perhaps on second thoughts maybe some alternative so as to not tightly couple the server with Management Portal

stale commented

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

blootsvoets commented

FYI: for example the Gateway abstracts away from management portal by allowing multiple implementations for authentication: https://github.com/RADAR-base/RADAR-Gateway/blob/master/src/main/kotlin/org/radarcns/gateway/auth/Auth.kt. Although permission names are taken from MP, you can as well implement a mapping for another authorization provider. Implementations:

yatharthranjan commented

Ok great, Thanks. Is there a standard for the permission names so that other OAuth providers can also be used by just implementing the Auth interface (for example, without changing the annotations)?

blootsvoets commented

Yes, most providers allow setting the scope. The scope name is <Entity>.<Operation>., for example, PROJECT.READ, SUBJECT.UPDATE, MEASUREMENT.CREATE. For a full list, see https://github.com/RADAR-base/ManagementPortal/blob/dev/radar-auth/src/main/java/org/radarcns/auth/authorization/Permission.java

  • 👍1
yatharthranjan commented

okay. Thanks

yatharthranjan commented

Closed by #27