felix.ruizdearcaute/app-organization-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

acm idm roles

Browse Source
This commit is contained in:
Nordine Bittich
2021-12-03 10:56:37 +01:00
parent 566ec39d9a
commit 3541a5f66b
7 changed files with 170 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@@ -25,4 +25,5 @@ DS_STORE
source.json
out.json
security.yml
security.yml
config/proxy-https/proxy_ssl.conf

69
config/authorization/config.ex
View File

@@ -59,7 +59,8 @@ defmodule Acl.UserGroups.Config do
]
defp access_by_role( group_string ) do
%AccessByQuery{
vars: ["session_group","session_role"],
# vars: ["session_group","session_role"], todo we might have to create multiple graph depending on role
vars: [],
query: sparql_query_for_access_role( group_string ) }
end
@@ -76,20 +77,38 @@ defmodule Acl.UserGroups.Config do
def user_groups do
[
%GroupSpec{
name: "acmidm",
useage: [:read, :write, :read_for_write],
access: %AccessByQuery{
query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
PREFIX session: <http://mu.semte.ch/vocabularies/session/>
SELECT ?account WHERE {
<SESSION_ID> session:account ?account.
} LIMIT 1",
vars: []
},
name: "acmidm-lezer",
useage: [:read],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-lezer" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin",
graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type
}
}
]
},
%GroupSpec{
name: "acmidm-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-editeerder" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type
}
}
]
},
%GroupSpec{
name: "acmidm-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-beheerder" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type
}
@@ -97,11 +116,27 @@ defmodule Acl.UserGroups.Config do
]
},
%GroupSpec{
name: "ch-admin",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ChAdmin" ),
name: "ch-lezer",
useage: [:read],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-lezer" ),
graphs: [ %GraphSpec{
graph: "http://mu.semte.ch/graphs/contacthub/",
graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type } } ] },
%GroupSpec{
name: "ch-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-editeerder" ),
graphs: [ %GraphSpec{
graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type } } ] },
%GroupSpec{
name: "ch-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-beheerder" ),
graphs: [ %GraphSpec{
graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type } } ] },
%GroupSpec{

2
config/delta/rules.js
View File

@@ -3,7 +3,7 @@ export default [
match: {
graph: {
type: "uri",
value: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin"
value: "http://mu.semte.ch/graphs/organisatieportaal"
}
},
callback: {

13
config/migrations/2022212411511111121112333224-bestuur-admidm.sparql Normal file
View File

@@ -0,0 +1,13 @@
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
PREFIX dcterms: <http://purl.org/dc/terms/>
PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>
INSERT DATA {
GRAPH <http://mu.semte.ch/graphs/contacthub/accounts> {
<http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> a besluit:Bestuurseenheid ;
mu:uuid "141d9d6b-54af-4d17-b313-8d1c30bc3f5b" ;
skos:prefLabel "Agentschap Binnenlands Bestuur" ;
dcterms:identifier "OVO001835" .
}
}

91
config/migrations/2022212411511111121112333225-mock-user-roles.sparql Normal file
View File

@@ -0,0 +1,91 @@
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
PREFIX dcterms: <http://purl.org/dc/terms/>
PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>
DELETE {
GRAPH <http://mu.semte.ch/graphs/public> {
?s ?p ?o
}
} INSERT {
GRAPH <http://mu.semte.ch/graphs/public> {
<http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> a besluit:Bestuurseenheid ;
mu:uuid "141d9d6b-54af-4d17-b313-8d1c30bc3f5b" ;
skos:prefLabel "Agentschap Binnenlands Bestuur" ;
dcterms:identifier "OVO001835" .
<http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3470> a foaf:Person ;
mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ;
foaf:firstName "Josephine" ;
foaf:familyName "Lezer" ;
foaf:member <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> ;
foaf:account <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956> .
<http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956> a foaf:OnlineAccount ;
mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0956" ;
foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
ext:sessionRole "ABBOrganisatiePortaalGebruiker-lezer".
<http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3471> a foaf:Person ;
mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3471" ;
foaf:firstName "Josephine" ;
foaf:familyName "Editeerder" ;
foaf:member <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> ;
foaf:account <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0957> .
<http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0957> a foaf:OnlineAccount ;
mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0957" ;
foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
ext:sessionRole "ABBOrganisatiePortaalGebruiker-editeerder".
<http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3472> a foaf:Person ;
mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3472" ;
foaf:firstName "Josephine" ;
foaf:familyName "Beheerder" ;
foaf:member <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> ;
foaf:account <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0958> .
<http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0958> a foaf:OnlineAccount ;
mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0958" ;
foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
ext:sessionRole "ABBOrganisatiePortaalGebruiker-beheerder".
}
GRAPH <http://mu.semte.ch/graphs/organizations/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> {
<http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3470> a foaf:Person ;
mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ;
foaf:firstName "Josephine" ;
foaf:familyName "Lezer" ;
foaf:member <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> ;
foaf:account <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956> .
<http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956> a foaf:OnlineAccount ;
mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0956" ;
foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
ext:sessionRole "ABBOrganisatiePortaalGebruiker-lezer".
<http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3471> a foaf:Person ;
mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3471" ;
foaf:firstName "Josephine" ;
foaf:familyName "Editeerder" ;
foaf:member <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> ;
foaf:account <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0957> .
<http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0957> a foaf:OnlineAccount ;
mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0957" ;
foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
ext:sessionRole "ABBOrganisatiePortaalGebruiker-editeerder".
<http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3472> a foaf:Person ;
mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3472" ;
foaf:firstName "Josephine" ;
foaf:familyName "Beheerder" ;
foaf:member <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> ;
foaf:account <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0958> .
<http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0958> a foaf:OnlineAccount ;
mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0958" ;
foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
ext:sessionRole "ABBOrganisatiePortaalGebruiker-beheerder".
}
} WHERE {
GRAPH <http://mu.semte.ch/graphs/public> {
?s ?p ?o
}
}

8
config/migrations/2022212411511111121112333226-move-graph.sparql Normal file
View File

@@ -0,0 +1,8 @@
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
PREFIX dcterms: <http://purl.org/dc/terms/>
PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>
MOVE <http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin> TO
<http://mu.semte.ch/graphs/organisatieportaal>

8
docker-compose.yml
View File

@@ -111,17 +111,15 @@ services:
restart: always
logging: *default-logging
login:
image: lblod/acmidm-login-service:0.9.3-organisatie_portaal
links:
- db:database
image: lblod/acmidm-login-service:0.9.2
environment:
MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts"
MU_APPLICATION_AUTH_ROLE_CLAIM: "abb_organisatieportaal_rol_3d"
MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op"
MU_APPLICATION_AUTH_CLIENT_ID: "677af572-2e2f-4e61-ad38-036723bb314c"
MU_APPLICATION_AUTH_REDIRECT_URI: "https://organisaties.abb.lblod.info/authorization/callback"
MU_APPLICATION_AUTH_CLIENT_SECRET: "secret"
links:
- db:database
labels:
- "logging=true"
restart: always