diff --git a/.gitignore b/.gitignore
index be3b6dc..39c29a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,4 +25,5 @@ DS_STORE
source.json
out.json
-security.yml
\ No newline at end of file
+security.yml
+config/proxy-https/proxy_ssl.conf
diff --git a/config/authorization/config.ex b/config/authorization/config.ex
index a94aaab..831ee72 100644
--- a/config/authorization/config.ex
+++ b/config/authorization/config.ex
@@ -59,7 +59,8 @@ defmodule Acl.UserGroups.Config do
]
defp access_by_role( group_string ) do
%AccessByQuery{
- vars: ["session_group","session_role"],
+# vars: ["session_group","session_role"], todo we might have to create multiple graph depending on role
+ vars: [],
query: sparql_query_for_access_role( group_string ) }
end
@@ -76,20 +77,38 @@ defmodule Acl.UserGroups.Config do
def user_groups do
[
%GroupSpec{
- name: "acmidm",
- useage: [:read, :write, :read_for_write],
- access: %AccessByQuery{
- query: "PREFIX ext:
- PREFIX mu:
- PREFIX session:
- SELECT ?account WHERE {
- session:account ?account.
- } LIMIT 1",
- vars: []
- },
+ name: "acmidm-lezer",
+ useage: [:read],
+ access: access_by_role( "ABBOrganisatiePortaalGebruiker-lezer" ),
graphs: [
%GraphSpec{
- graph: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin",
+ graph: "http://mu.semte.ch/graphs/organisatieportaal",
+ constraint: %ResourceConstraint{
+ resource_types: @protected_resource_type
+ }
+ }
+ ]
+ },
+ %GroupSpec{
+ name: "acmidm-editeerder",
+ useage: [:read, :write, :read_for_write],
+ access: access_by_role( "ABBOrganisatiePortaalGebruiker-editeerder" ),
+ graphs: [
+ %GraphSpec{
+ graph: "http://mu.semte.ch/graphs/organisatieportaal",
+ constraint: %ResourceConstraint{
+ resource_types: @protected_resource_type
+ }
+ }
+ ]
+ },
+ %GroupSpec{
+ name: "acmidm-beheerder",
+ useage: [:read, :write, :read_for_write],
+ access: access_by_role( "ABBOrganisatiePortaalGebruiker-beheerder" ),
+ graphs: [
+ %GraphSpec{
+ graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type
}
@@ -97,11 +116,27 @@ defmodule Acl.UserGroups.Config do
]
},
%GroupSpec{
- name: "ch-admin",
- useage: [:read, :write, :read_for_write],
- access: access_by_role( "ChAdmin" ),
+ name: "ch-lezer",
+ useage: [:read],
+ access: access_by_role( "ABBOrganisatiePortaalGebruiker-lezer" ),
graphs: [ %GraphSpec{
- graph: "http://mu.semte.ch/graphs/contacthub/",
+ graph: "http://mu.semte.ch/graphs/organisatieportaal",
+ constraint: %ResourceConstraint{
+ resource_types: @protected_resource_type } } ] },
+ %GroupSpec{
+ name: "ch-editeerder",
+ useage: [:read, :write, :read_for_write],
+ access: access_by_role( "ABBOrganisatiePortaalGebruiker-editeerder" ),
+ graphs: [ %GraphSpec{
+ graph: "http://mu.semte.ch/graphs/organisatieportaal",
+ constraint: %ResourceConstraint{
+ resource_types: @protected_resource_type } } ] },
+ %GroupSpec{
+ name: "ch-beheerder",
+ useage: [:read, :write, :read_for_write],
+ access: access_by_role( "ABBOrganisatiePortaalGebruiker-beheerder" ),
+ graphs: [ %GraphSpec{
+ graph: "http://mu.semte.ch/graphs/organisatieportaal",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type } } ] },
%GroupSpec{
diff --git a/config/delta/rules.js b/config/delta/rules.js
index 5476fc4..8d1b1ca 100644
--- a/config/delta/rules.js
+++ b/config/delta/rules.js
@@ -3,7 +3,7 @@ export default [
match: {
graph: {
type: "uri",
- value: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin"
+ value: "http://mu.semte.ch/graphs/organisatieportaal"
}
},
callback: {
diff --git a/config/migrations/2022212411511111121112333224-bestuur-admidm.sparql b/config/migrations/2022212411511111121112333224-bestuur-admidm.sparql
new file mode 100644
index 0000000..a47e046
--- /dev/null
+++ b/config/migrations/2022212411511111121112333224-bestuur-admidm.sparql
@@ -0,0 +1,13 @@
+PREFIX mu:
+PREFIX skos:
+PREFIX dcterms:
+PREFIX besluit:
+
+INSERT DATA {
+ GRAPH {
+ a besluit:Bestuurseenheid ;
+ mu:uuid "141d9d6b-54af-4d17-b313-8d1c30bc3f5b" ;
+ skos:prefLabel "Agentschap Binnenlands Bestuur" ;
+ dcterms:identifier "OVO001835" .
+ }
+}
\ No newline at end of file
diff --git a/config/migrations/2022212411511111121112333225-mock-user-roles.sparql b/config/migrations/2022212411511111121112333225-mock-user-roles.sparql
new file mode 100644
index 0000000..fb3a265
--- /dev/null
+++ b/config/migrations/2022212411511111121112333225-mock-user-roles.sparql
@@ -0,0 +1,91 @@
+PREFIX mu:
+PREFIX skos:
+PREFIX dcterms:
+PREFIX besluit:
+PREFIX foaf:
+PREFIX ext:
+ DELETE {
+ GRAPH {
+ ?s ?p ?o
+ }
+ } INSERT {
+ GRAPH {
+ a besluit:Bestuurseenheid ;
+ mu:uuid "141d9d6b-54af-4d17-b313-8d1c30bc3f5b" ;
+ skos:prefLabel "Agentschap Binnenlands Bestuur" ;
+ dcterms:identifier "OVO001835" .
+
+ a foaf:Person ;
+ mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ;
+ foaf:firstName "Josephine" ;
+ foaf:familyName "Lezer" ;
+ foaf:member ;
+ foaf:account .
+ a foaf:OnlineAccount ;
+ mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0956" ;
+ foaf:accountServiceHomepage ;
+ ext:sessionRole "ABBOrganisatiePortaalGebruiker-lezer".
+
+ a foaf:Person ;
+ mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3471" ;
+ foaf:firstName "Josephine" ;
+ foaf:familyName "Editeerder" ;
+ foaf:member ;
+ foaf:account .
+ a foaf:OnlineAccount ;
+ mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0957" ;
+ foaf:accountServiceHomepage ;
+ ext:sessionRole "ABBOrganisatiePortaalGebruiker-editeerder".
+
+ a foaf:Person ;
+ mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3472" ;
+ foaf:firstName "Josephine" ;
+ foaf:familyName "Beheerder" ;
+ foaf:member ;
+ foaf:account .
+ a foaf:OnlineAccount ;
+ mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0958" ;
+ foaf:accountServiceHomepage ;
+ ext:sessionRole "ABBOrganisatiePortaalGebruiker-beheerder".
+ }
+
+ GRAPH {
+
+ a foaf:Person ;
+ mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ;
+ foaf:firstName "Josephine" ;
+ foaf:familyName "Lezer" ;
+ foaf:member ;
+ foaf:account .
+ a foaf:OnlineAccount ;
+ mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0956" ;
+ foaf:accountServiceHomepage ;
+ ext:sessionRole "ABBOrganisatiePortaalGebruiker-lezer".
+
+ a foaf:Person ;
+ mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3471" ;
+ foaf:firstName "Josephine" ;
+ foaf:familyName "Editeerder" ;
+ foaf:member ;
+ foaf:account .
+ a foaf:OnlineAccount ;
+ mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0957" ;
+ foaf:accountServiceHomepage ;
+ ext:sessionRole "ABBOrganisatiePortaalGebruiker-editeerder".
+
+ a foaf:Person ;
+ mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3472" ;
+ foaf:firstName "Josephine" ;
+ foaf:familyName "Beheerder" ;
+ foaf:member ;
+ foaf:account .
+ a foaf:OnlineAccount ;
+ mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0958" ;
+ foaf:accountServiceHomepage ;
+ ext:sessionRole "ABBOrganisatiePortaalGebruiker-beheerder".
+ }
+ } WHERE {
+ GRAPH {
+ ?s ?p ?o
+ }
+ }
\ No newline at end of file
diff --git a/config/migrations/2022212411511111121112333226-move-graph.sparql b/config/migrations/2022212411511111121112333226-move-graph.sparql
new file mode 100644
index 0000000..6279267
--- /dev/null
+++ b/config/migrations/2022212411511111121112333226-move-graph.sparql
@@ -0,0 +1,8 @@
+PREFIX mu:
+PREFIX skos:
+PREFIX dcterms:
+PREFIX besluit:
+PREFIX foaf:
+PREFIX ext:
+MOVE TO
+
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index c528e2f..7eb1ff9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -111,17 +111,15 @@ services:
restart: always
logging: *default-logging
login:
- image: lblod/acmidm-login-service:0.9.3-organisatie_portaal
- links:
- - db:database
+ image: lblod/acmidm-login-service:0.9.2
environment:
+ MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts"
+ MU_APPLICATION_AUTH_ROLE_CLAIM: "abb_organisatieportaal_rol_3d"
MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op"
MU_APPLICATION_AUTH_CLIENT_ID: "677af572-2e2f-4e61-ad38-036723bb314c"
MU_APPLICATION_AUTH_REDIRECT_URI: "https://organisaties.abb.lblod.info/authorization/callback"
MU_APPLICATION_AUTH_CLIENT_SECRET: "secret"
- links:
- - db:database
labels:
- "logging=true"
restart: always