Add acmidm for the dashboard

config/authorization/config.ex

@@ -111,11 +111,9 @@ defmodule Acl.UserGroups.Config do
     %AccessByQuery{
       vars: [],
       query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
-        PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
-        SELECT DISTINCT ?account WHERE {
-          <SESSION_ID> <http://mu.semte.ch/vocabularies/session/account> ?account.
-          ?account <http://mu.semte.ch/vocabularies/ext/sessionRole> ?session_role.
-          FILTER( ?session_role = \"dashboard-user\" )
+        SELECT DISTINCT ?session WHERE {
+          VALUES ?session { <SESSION_ID> }
+          ?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
         }"
     }
   end
@@ -219,10 +217,10 @@ defmodule Acl.UserGroups.Config do
           }
         ]
       },
-      # // dashboard users
+      # // Dashboard admin
       %GroupSpec{
-        name: "dashboard-users",
-        useage: [:read],
+        name: "o-admin-rwf",
+        useage: [:read, :write, :read_for_write],
         access: can_access_dashboard(),
         graphs: [
           %GraphSpec{

config/dispatcher/dispatcher.ex

@@ -306,7 +306,7 @@ defmodule Dispatcher do
   end
 
   match "/sessions/*path", %{ reverse_host: ["dashboard" | _rest] } do
-    Proxy.forward conn, path, "http://dashboard-login/sessions/"
+    Proxy.forward conn, path, "http://login-dashboard/sessions/"
   end
 
   match "/sessions/*path", %{accept: [:any], layer: :api} do

config/migrations/2025/20250904115406-add-dashboard-admin-role-to-mock-abb-user.sparql

@@ -0,0 +1,17 @@
+PREFIX foaf: <http://xmlns.com/foaf/0.1/>
+PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>
+
+INSERT {
+  GRAPH ?g {
+    ?account ext:sessionRole "LoketLB-AdminDashboardOrganisatiePortaalGebruiker" .
+  }
+}
+WHERE {
+  VALUES ?account {
+    <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956>
+  }
+
+  GRAPH ?g {
+    ?account ext:sessionRole ?role .
+  }
+}

docker-compose.dev.yml

@@ -40,6 +40,8 @@ services:
     restart: "no"
   login:
     restart: "no"
+  login-dashboard:
+    restart: "no"
   accountdetail:
     restart: "no"
   privacy-unit:
@@ -50,6 +52,10 @@ services:
     restart: "no"
   frontend:
     restart: "no"
+  frontend-dashboard:
+    # environment:
+      # EMBER_LOGIN_ROUTE: "mock-login"
+    restart: "no"
   uri-info:
     restart: "no"
   delta-producer-background-jobs-initiator:

docker-compose.yml

@@ -122,7 +122,7 @@ services:
     restart: always
     logging: *default-logging
   sink:
-    image: nginx:1.15.2
+    image: nginx:1.25.1
     volumes:
       - ./config/sink/sink.conf:/etc/nginx/conf.d/default.conf
     labels:
@@ -145,10 +145,17 @@ services:
     logging: *default-logging
     links:
       - db:database
-  dashboard-login:
-    image: semtech/mu-login-service:3.0.0
-    links:
-      - db:database
+  login-dashboard:
+    image: lblod/acmidm-login-service:0.12.0
+    environment:
+      LOG_SINK_URL: "http://sink"
+      MU_APPLICATION_AUTH_ROLE_CLAIM: "abb_organisatieportaal_rol_3d"
+      # MU_APPLICATION_AUTH_USERID_CLAIM: "sub" #TODO: check if needed?
+      # MU_APPLICATION_AUTH_ACCOUNTID_CLAIM: "sub"
+      MU_APPLICATION_AUTH_DISCOVERY_URL: "<ACM_IDM_AUTH_DISCOVERY_URL>"
+      MU_APPLICATION_AUTH_CLIENT_ID: "<ACM_IDM_AUTH_CLIENT_ID>"
+      MU_APPLICATION_AUTH_REDIRECT_URI: "<ACMIDM_AUTH_REDIRECT_URI>"
+      MU_APPLICATION_AUTH_CLIENT_SECRET: "<ACMIDM_AUTH_CLIENT_SECRET>"
     labels:
       - "logging=true"
     restart: always
@@ -209,7 +216,15 @@ services:
     restart: always
     logging: *default-logging
   frontend-dashboard:
-    image: lblod/frontend-dashboard:1.7.0
+    image: lblod/frontend-dashboard:1.9.0
+    environment:
+      EMBER_LOGIN_ROUTE: "acmidm-login"
+      EMBER_DISABLE_ERRORS: "true"
+      EMBER_ACMIDM_CLIENT_ID: "<CLIENT_ID>"
+      EMBER_ACMIDM_BASE_URL: "<BASE_URL>"
+      EMBER_ACMIDM_REDIRECT_URL: "<REDIRECT_URL>"
+      EMBER_ACMIDM_LOGOUT_URL: "<LOGOUT_URL>"
+      EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal"
     labels:
       - "logging=true"
     restart: always