Comments (3)
Meeting Notes (06/10/2023)
- The scope of this feature is to add visibility support for both backoffice and devportal. Implementation will start with adding devportal visibility first.
- backoffice visibility : access control, defines who can edit the API
- devportal visibility : defines who can view/subscribe the API
- No need to store group/role information on APK side, these will be extracted from a predefined claim that can be configured in the OAuth Provider.
- When adding APIs user should mention the roles/groups the API will be visible on backoffice and devportal. This information will be stored in the DB in API table's ARTIFACT JSONB field.
- In case the same group/role exist in two OAuth Providers, there should be a way to distinguish which OAuth Provider's group/role the API was meant to be visible to. Therefore, store both OAuth provider and group details when adding visible groups.
Thanks,
Sachini
from apk.
Status Update (10/10/2023)
- Got the backoffice internal API working and successfully added changes in backoffice to persist the devportal visibility settings in the DB artifact field. But ran into below issues when trying to fetch the API through backoffice and deportal APIs.
- Tried to invoke the backoffice and devportal /apis GET resources by passing the token in Authorization header. Even though the token has the required scope(apk:api:view) it still returned a 401.
- Added logs in JWTValidationInterceptor.bal and identified that the authorization token is not properly extracted, this was because the service expects the token to be passed in
X-JWT-Assersion
header instead. - Even though I passed the token in
X-JWT-Assertion
still got below error while validating the token.
error: invalid Token {"code":900954,"message":"invalid Token","statusCode":401,"description":"invalid Token","moreInfo":{}}
at wso2.apk_common_lib.0:validateJWT(JWTValidationInterceptor.bal:75)
wso2.apk_common_lib.0:$default$^^(JWTValidationInterceptor.bal:32)
cause: JWT contained invalid issuer name 'https://idp.am.wso2.com/token'
at ballerina.jwt.2:prepareError(jwt_errors.bal:29)
ballerina.jwt.2:validateIssuer(jwt_validator.bal:569)
ballerina.jwt.2:validateJwtRecords(jwt_validator.bal:378)
ballerina.jwt.2:validateJwt(jwt_validator.bal:123)
ballerina.jwt.2:validate(jwt_validator.bal:114)
wso2.apk_common_lib.0:validateJWT(JWTValidationInterceptor.bal:47)
... 1 more
- Had a discussion with Sampath, Krishan and TharinduA, backoffice API cannot be accessed directly the request should go through the gateway. Successfully invoked the /apis GET resource that way via below url
https://default.gw.wso2.com:9095/api/backoffice/1.0.0/api/backoffice/apis
- Improved the devportal DAO query to filter based on visibility roles as well using JSONB operators[1]. For the moment I have hardcoded the list of roles of the current user, need to improve the logic to extract this info from the user context.
[1]. https://www.postgresql.org/docs/9.5/functions-json.html
from apk.
Status Update (12/10/2023)
- Added a claim mapping for groups. Internally the groups claim will be regarded as
x-wso2-groups
. Tested whether this claim value is passed to the ballerina service level through the authenticated user context (with both default IDP and asgardeo). - In asgardeo the groups claim is passed in the JWT as a json[] during the sync up meeting it was decided to allow OauthProviders to pass groups as a json[] or a comma separated string, internal logic should be modified to handle both scenarios.
- Updated the parameterized queries to filter the APIs based on the visibility level and the user groups. Used
arrayFlattenQuery
to pass the groups list into the query.
[1]. https://lib.ballerina.io/ballerina/sql/latest
from apk.
Related Issues (20)
- Code redundancy in agent-integration tests
- Proto parser has limitations (feature/grpc branch)
- API deployment not working (APIM 4.3.0 as control plan) HOT 2
- APIM 4.3.0 locally DP runs K8s Rancher and mixing up subscription information HOT 1
- Support for Gateway API supported filters for HTTPRoutes HOT 5
- Upgrade go version
- Installation issue in APK 1.1.0 HOT 2
- Add header modifier, request redirect and request mirroring support in Agent
- Cine Mundo
- Hostname verification failure in system routes in gateway.
- Test issue
- Adapter Attempts to Update Owner Reference of Unrelated Artifacts
- Complete API Key functionality HOT 1
- Add API gateway conformance tests HOT 7
- Need to add enterprise approach to APK 1.1.0
- Evaluate Adding SSE API Support for APK
- Header base routing support for multiple backend
- Integrate API controller with new gateway api controllers
- Disable resource level security not reflecting correctly
- GRPC support
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from apk.