diff --git a/CHANGELOG.md b/CHANGELOG.md index 908336a..55368ac 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,44 @@ # Changelog ## Unreleased +### Dashboard +- Enable ACM/IDM for the dashboard [OP-3674] + +#### QA +Configure the environment variables for the QA ACM/IDM environment: + +```yml + frontend-dashboard: + environment: + EMBER_ACMIDM_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a" + EMBER_ACMIDM_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth" + EMBER_ACMIDM_REDIRECT_URL: "https://dashboard.organisaties.abb.lblod.info/authorization/callback" + EMBER_ACMIDM_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout" + EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal" + + login-dashboard: + environment: + MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op" + MU_APPLICATION_AUTH_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a" + MU_APPLICATION_AUTH_REDIRECT_URI: "https://dashboard.organisaties.abb.lblod.info/authorization/callback" + MU_APPLICATION_AUTH_CLIENT_SECRET: "snip" # see ticket for secret + +``` + +Link the new domain name to QA (and remove from dev) + +#### PROD +Configure the environment variables for the PROD ACM/IDM environment once the values are known. + +Link the new domain name to PROD + DNS config to the server + +#### CLI +``` +drc restart migrations +drc restart dispatcher database +drc up -d --remove-orphans +``` + ### Frontend - Bump to [v1.34.1](https://github.com/lblod/frontend-organization-portal/releases/tag/v1.34.1) [OP-3638] - Remove province for addresses in the Brussels area [OP-3638] & [OP-3648] diff --git a/README.md b/README.md index 1884f32..4fa218d 100644 --- a/README.md +++ b/README.md @@ -185,26 +185,3 @@ To make sure the app can share data, producers need to be set up. There is an in ) } ``` - -## Configuring the dashboard -### Accessing the dashboard from your local machine - -Since we use dispatcher v2, which dispatches on hostname, we'll have to update `/etc/hosts`. -Add an entry similar to the following. Ensure the first part of the domain starts with `dashboard`.: - -``` -127.0.0.1 dashboard.localhost -``` - -### Creating new users -For now, we use specific logins for the dashboard users. Each environment has its own passwords. - -To add a user, make sure to have [mu-cli](https://github.com/mu-semtech/mu-cli) installed first. -Then in `docker-compose.override.yml` -``` - dashboard-login: - environment: - MU_APPLICATION_SALT: 'a_random_string_with_sufficient_entropy_hence_not_this_one' -``` -You can now generate a user by running `mu script project-scripts generate-dashboard-login` and following the steps. -Restart `migrations` and it should insert the new user into the database. \ No newline at end of file diff --git a/config/authorization/config.ex b/config/authorization/config.ex index 0390610..2ef99a3 100644 --- a/config/authorization/config.ex +++ b/config/authorization/config.ex @@ -111,11 +111,9 @@ defmodule Acl.UserGroups.Config do %AccessByQuery{ vars: [], query: "PREFIX ext: - PREFIX mu: - SELECT DISTINCT ?account WHERE { - ?account. - ?account ?session_role. - FILTER( ?session_role = \"dashboard-user\" ) + SELECT DISTINCT ?session WHERE { + VALUES ?session { } + ?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" . }" } end @@ -219,10 +217,10 @@ defmodule Acl.UserGroups.Config do } ] }, - # // dashboard users + # // Dashboard admin %GroupSpec{ - name: "dashboard-users", - useage: [:read], + name: "o-admin-rwf", + useage: [:read, :write, :read_for_write], access: can_access_dashboard(), graphs: [ %GraphSpec{ diff --git a/config/dispatcher/dispatcher.ex b/config/dispatcher/dispatcher.ex index 5100511..4a1591d 100644 --- a/config/dispatcher/dispatcher.ex +++ b/config/dispatcher/dispatcher.ex @@ -306,7 +306,7 @@ defmodule Dispatcher do end match "/sessions/*path", %{ reverse_host: ["dashboard" | _rest] } do - Proxy.forward conn, path, "http://dashboard-login/sessions/" + Proxy.forward conn, path, "http://login-dashboard/sessions/" end match "/sessions/*path", %{accept: [:any], layer: :api} do diff --git a/config/migrations/2025/20250904115406-add-dashboard-admin-role-to-mock-abb-user.sparql b/config/migrations/2025/20250904115406-add-dashboard-admin-role-to-mock-abb-user.sparql new file mode 100644 index 0000000..312405c --- /dev/null +++ b/config/migrations/2025/20250904115406-add-dashboard-admin-role-to-mock-abb-user.sparql @@ -0,0 +1,17 @@ +PREFIX foaf: +PREFIX ext: + +INSERT { + GRAPH ?g { + ?account ext:sessionRole "LoketLB-AdminDashboardOrganisatiePortaalGebruiker" . + } +} +WHERE { + VALUES ?account { + + } + + GRAPH ?g { + ?account ext:sessionRole ?role . + } +} diff --git a/config/tlsproxy-mock/Caddyfile b/config/tlsproxy-mock/Caddyfile index b041c33..a40c65b 100644 --- a/config/tlsproxy-mock/Caddyfile +++ b/config/tlsproxy-mock/Caddyfile @@ -1,4 +1,4 @@ -https://{$OP_ADDRESS} { +https://{$APPLICATION_ADDRESS} { reverse_proxy identifier:80 tls internal } diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 6ff8a35..3231ca2 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -40,6 +40,8 @@ services: restart: "no" login: restart: "no" + login-dashboard: + restart: "no" accountdetail: restart: "no" privacy-unit: @@ -50,6 +52,10 @@ services: restart: "no" frontend: restart: "no" + frontend-dashboard: + environment: + EMBER_LOGIN_ROUTE: "mock-login" + restart: "no" uri-info: restart: "no" delta-producer-background-jobs-initiator: diff --git a/docker-compose.yml b/docker-compose.yml index cbdab10..0d8b29e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -122,7 +122,7 @@ services: restart: always logging: *default-logging sink: - image: nginx:1.15.2 + image: nginx:1.25.1 volumes: - ./config/sink/sink.conf:/etc/nginx/conf.d/default.conf labels: @@ -130,7 +130,7 @@ services: restart: always logging: *default-logging login: - image: lblod/acmidm-login-service:0.9.2 + image: lblod/acmidm-login-service:0.12.0 environment: MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id" MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts" @@ -145,14 +145,22 @@ services: logging: *default-logging links: - db:database - dashboard-login: - image: semtech/mu-login-service:3.0.0 - links: - - db:database + login-dashboard: + image: lblod/acmidm-login-service:0.12.0 + environment: + LOG_SINK_URL: "http://sink" + MU_APPLICATION_AUTH_ROLE_CLAIM: "abb_organisatieportaal_rol_2d" + MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id" + MU_APPLICATION_AUTH_DISCOVERY_URL: "" + MU_APPLICATION_AUTH_CLIENT_ID: "" + MU_APPLICATION_AUTH_REDIRECT_URI: "" + MU_APPLICATION_AUTH_CLIENT_SECRET: "" labels: - "logging=true" restart: always logging: *default-logging + links: + - db:database accountdetail: image: lblod/account-detail-service:0.1.0 labels: @@ -209,7 +217,15 @@ services: restart: always logging: *default-logging frontend-dashboard: - image: lblod/frontend-dashboard:1.7.0 + image: lblod/frontend-dashboard:1.10.0 + environment: + EMBER_LOGIN_ROUTE: "acmidm-login" + EMBER_ACMIDM_CLIENT_ID: "" + EMBER_ACMIDM_BASE_URL: "" + EMBER_ACMIDM_REDIRECT_URL: "" + EMBER_ACMIDM_LOGOUT_URL: "" + EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal" + EMBER_ENGLISH_ACCOUNTS_MODEL: true labels: - "logging=true" restart: always diff --git a/scripts/project/config.json b/scripts/project/config.json index 66a03a0..6e4cda6 100644 --- a/scripts/project/config.json +++ b/scripts/project/config.json @@ -48,21 +48,6 @@ "mounts": { "app": "/data/app/" } - }, - { - "documentation": { - "command": "generate-dashboard-login", - "description": "generate a login account for the jobs dashboard", - "arguments": [] - }, - "environment": { - "image": "ruby", - "interactive": true, - "script": "generate-dashboard-login/run.sh" - }, - "mounts": { - "app": "/project/" - } } ] -} \ No newline at end of file +} diff --git a/scripts/project/generate-dashboard-login/run.sh b/scripts/project/generate-dashboard-login/run.sh deleted file mode 100755 index 03f4aba..0000000 --- a/scripts/project/generate-dashboard-login/run.sh +++ /dev/null @@ -1,80 +0,0 @@ -#!/usr/bin/env ruby -require 'bundler/inline' -require 'yaml' -require 'securerandom' -require 'date' - -$stdout.sync = true -print "installing dependencies..." -gemfile do - source 'https://rubygems.org' - gem 'bcrypt' -end -puts "done" - -salt = "" -begin - File.open("/project/docker-compose.override.yml") do |file| - config = YAML.load(file) - salt = config.dig("services", "dashboard-login", "environment", "MU_APPLICATION_SALT") - throw "invalid salt" unless salt - end -rescue - puts "Tried to locate login salt in docker-compose.override.yml, but couldn't find it." - puts "Please make sure a salt is configured:" - puts < -PREFIX people: -PREFIX accounts: -PREFIX dcterms: -PREFIX mu: -PREFIX ext: -PREFIX account: -PREFIX xsd: -INSERT DATA { - GRAPH { - people:#{person_uuid} a foaf:Person ; - foaf:name "#{account_name}"; - foaf:account accounts:#{account_uuid}; - mu:uuid "#{person_uuid}"; - dcterms:created "#{now}"^^xsd:datetime; - dcterms:modified "#{now}"^^xsd:datetime. - accounts:#{account_uuid} a foaf:OnlineAccount; - foaf:accountName "#{account_name}"; - mu:uuid "#{account_uuid}"; - account:password """#{hashed_password}"""; - account:salt "#{account_salt}"; - account:status ; - dcterms:created "#{now}"^^xsd:datetime; - ext:sessionRole "dashboard-user"; - dcterms:modified "#{now}"^^xsd:datetime. -}} -) - -timestamp = DateTime.now.strftime("%Y%m%d%H%M%L") -filename = "#{timestamp}-create-user-#{account_name.gsub(" ", "-")}.sparql" -File.write("/project/config/migrations/local/#{filename}", query) -puts "generated migration ./config/migrations/local/#{filename} for #{account_name.inspect} : #{password.inspect}" \ No newline at end of file