Release v1.36.0

[OP-3674]: use acmidm for dashboard

CHANGELOG.md

@@ -1,4 +1,54 @@
 # Changelog
+
+## 1.36.0 (2025-10-03)
+### Dashboard
+- Enable ACM/IDM for the dashboard [OP-3674]
+
+#### QA
+Configure the environment variables for the QA ACM/IDM environment:
+
+```yml
+  frontend-dashboard:
+    environment:
+      EMBER_ACMIDM_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a"
+      EMBER_ACMIDM_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth"
+      EMBER_ACMIDM_REDIRECT_URL: "https://dashboard.organisaties.abb.lblod.info/authorization/callback"
+      EMBER_ACMIDM_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout"
+      EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal"
+
+  login-dashboard:
+    environment:
+      MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op"
+      MU_APPLICATION_AUTH_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a"
+      MU_APPLICATION_AUTH_REDIRECT_URI: "https://dashboard.organisaties.abb.lblod.info/authorization/callback"
+      MU_APPLICATION_AUTH_CLIENT_SECRET: "snip" # see ticket for secret
+
+```
+
+Link the new domain name to QA (and remove from dev)
+
+#### PROD
+Configure the environment variables for the PROD ACM/IDM environment once the values are known.
+
+Link the new domain name to PROD + DNS config to the server
+
+#### CLI
+```
+drc restart migrations
+drc restart dispatcher database
+drc up -d --remove-orphans
+```
+
+### Frontend
+- Bump to [v1.34.1](https://github.com/lblod/frontend-organization-portal/releases/tag/v1.34.1) [OP-3638]
+- Remove province for addresses in the Brussels area [OP-3638] & [OP-3648]
+
+### Deploy notes
+```
+drc pull frontend; drc up -d frontend
+drc restart migrations-triggering-indexing; drc logs -ft --tail=200 migrations-triggering-indexing
+```
+
 ## v1.35.1 (2025-09-15)
 ### Backend
 - Produce memberships and their roles in organizations and public producers [OP-3658] & [OP-3661]
@@ -19,6 +69,7 @@ drc restart delta-producer-publication-graph-maintainer
 - datafix: cleanup of duplicate memberships [OP-3634]
 - Fix KBO organizations' date formats [OP-3560]
 
+
 ### Deploy notes
 ```
 drc pull scope-of-operation; drc up -d scope-of-operation

README.md

@@ -185,26 +185,3 @@ To make sure the app can share data, producers need to be set up. There is an in
        )
      }
 ```
-
-## Configuring the dashboard
-### Accessing the dashboard from your local machine
-
-Since we use dispatcher v2, which dispatches on hostname, we'll have to update `/etc/hosts`.
-Add an entry similar to the following. Ensure the first part of the domain starts with `dashboard`.:
-
-```
-127.0.0.1 dashboard.localhost
-```
-
-### Creating new users
-For now, we use specific logins for the dashboard users. Each environment has its own passwords.
-
-To add a user, make sure to have [mu-cli](https://github.com/mu-semtech/mu-cli) installed first.
-Then in `docker-compose.override.yml`
-```
-  dashboard-login:
-    environment:
-      MU_APPLICATION_SALT: 'a_random_string_with_sufficient_entropy_hence_not_this_one'
-```
-You can now generate a user by running `mu script project-scripts generate-dashboard-login` and following the steps.
-Restart `migrations` and it should insert the new user into the database.

config/authorization/config.ex

@@ -111,11 +111,9 @@ defmodule Acl.UserGroups.Config do
     %AccessByQuery{
       vars: [],
       query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
-        PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+        SELECT DISTINCT ?session WHERE {
-        SELECT DISTINCT ?account WHERE {
+          VALUES ?session { <SESSION_ID> }
-          <SESSION_ID> <http://mu.semte.ch/vocabularies/session/account> ?account.
+          ?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
-          ?account <http://mu.semte.ch/vocabularies/ext/sessionRole> ?session_role.
-          FILTER( ?session_role = \"dashboard-user\" )
         }"
     }
   end
@@ -219,10 +217,10 @@ defmodule Acl.UserGroups.Config do
           }
         ]
       },
-      # // dashboard users
+      # // Dashboard admin
       %GroupSpec{
-        name: "dashboard-users",
+        name: "o-admin-rwf",
-        useage: [:read],
+        useage: [:read, :write, :read_for_write],
         access: can_access_dashboard(),
         graphs: [
           %GraphSpec{

config/dispatcher/dispatcher.ex

@@ -306,7 +306,7 @@ defmodule Dispatcher do
   end
 
   match "/sessions/*path", %{ reverse_host: ["dashboard" | _rest] } do
-    Proxy.forward conn, path, "http://dashboard-login/sessions/"
+    Proxy.forward conn, path, "http://login-dashboard/sessions/"
   end
 
   match "/sessions/*path", %{accept: [:any], layer: :api} do

config/migrations-triggering-indexing/2025/20250703095300-remove-province-for-addresses-in-brussels-gewest.sparql

@@ -0,0 +1,38 @@
+DELETE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?s <http://www.w3.org/ns/locn#adminUnitL2> ?province ;
+      <https://data.vlaanderen.be/ns/adres#adresIsGelegenIn> ?werkingsgebied .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    VALUES ?postCode {
+      "1070"
+      "1000"
+      "1020"
+      "1120"
+      "1130"
+      "1050"
+      "1040"
+      "1140"
+      "1083"
+      "1090"
+      "1081"
+      "1160"
+      "1030"
+      "1082"
+      "1060"
+      "1080"
+      "1210"
+      "1200"
+      "1150"
+      "1180"
+      "1190"
+      "1170"
+    }
+
+    ?s a <http://www.w3.org/ns/locn#Address> ;
+      <http://www.w3.org/ns/locn#postCode> ?postCode ;
+      <http://www.w3.org/ns/locn#adminUnitL2> ?province ;
+      <https://data.vlaanderen.be/ns/adres#adresIsGelegenIn> ?werkingsgebied .
+  }
+}

config/migrations/2025/20250904115406-add-dashboard-admin-role-to-mock-abb-user.sparql

@@ -0,0 +1,17 @@
+PREFIX foaf: <http://xmlns.com/foaf/0.1/>
+PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>
+
+INSERT {
+  GRAPH ?g {
+    ?account ext:sessionRole "LoketLB-AdminDashboardOrganisatiePortaalGebruiker" .
+  }
+}
+WHERE {
+  VALUES ?account {
+    <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956>
+  }
+
+  GRAPH ?g {
+    ?account ext:sessionRole ?role .
+  }
+}

config/tlsproxy-mock/Caddyfile

@@ -1,4 +1,4 @@
-https://{$OP_ADDRESS} {
+https://{$APPLICATION_ADDRESS} {
   reverse_proxy identifier:80
   tls internal
 }

docker-compose.dev.yml

@@ -40,6 +40,8 @@ services:
     restart: "no"
   login:
     restart: "no"
+  login-dashboard:
+    restart: "no"
   accountdetail:
     restart: "no"
   privacy-unit:
@@ -50,6 +52,10 @@ services:
     restart: "no"
   frontend:
     restart: "no"
+  frontend-dashboard:
+    environment:
+      EMBER_LOGIN_ROUTE: "mock-login"
+    restart: "no"
   uri-info:
     restart: "no"
   delta-producer-background-jobs-initiator:

docker-compose.yml

@@ -122,7 +122,7 @@ services:
     restart: always
     logging: *default-logging
   sink:
-    image: nginx:1.15.2
+    image: nginx:1.25.1
     volumes:
       - ./config/sink/sink.conf:/etc/nginx/conf.d/default.conf
     labels:
@@ -130,7 +130,7 @@ services:
     restart: always
     logging: *default-logging
   login:
-    image: lblod/acmidm-login-service:0.9.2
+    image: lblod/acmidm-login-service:0.12.0
     environment:
       MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
       MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts"
@@ -145,14 +145,22 @@ services:
     logging: *default-logging
     links:
       - db:database
-  dashboard-login:
+  login-dashboard:
-    image: semtech/mu-login-service:3.0.0
+    image: lblod/acmidm-login-service:0.12.0
-    links:
+    environment:
-      - db:database
+      LOG_SINK_URL: "http://sink"
+      MU_APPLICATION_AUTH_ROLE_CLAIM: "abb_organisatieportaal_rol_2d"
+      MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
+      MU_APPLICATION_AUTH_DISCOVERY_URL: "<ACM_IDM_AUTH_DISCOVERY_URL>"
+      MU_APPLICATION_AUTH_CLIENT_ID: "<ACM_IDM_AUTH_CLIENT_ID>"
+      MU_APPLICATION_AUTH_REDIRECT_URI: "<ACMIDM_AUTH_REDIRECT_URI>"
+      MU_APPLICATION_AUTH_CLIENT_SECRET: "<ACMIDM_AUTH_CLIENT_SECRET>"
     labels:
       - "logging=true"
     restart: always
     logging: *default-logging
+    links:
+      - db:database
   accountdetail:
     image: lblod/account-detail-service:0.1.0
     labels:
@@ -194,7 +202,7 @@ services:
     restart: always
     logging: *default-logging
   frontend:
-    image: lblod/frontend-organization-portal:1.34.0
+    image: lblod/frontend-organization-portal:1.34.1
     volumes:
       - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf
     environment:
@@ -209,7 +217,15 @@ services:
     restart: always
     logging: *default-logging
   frontend-dashboard:
-    image: lblod/frontend-dashboard:1.7.0
+    image: lblod/frontend-dashboard:1.10.0
+    environment:
+      EMBER_LOGIN_ROUTE: "acmidm-login"
+      EMBER_ACMIDM_CLIENT_ID: "<CLIENT_ID>"
+      EMBER_ACMIDM_BASE_URL: "<BASE_URL>"
+      EMBER_ACMIDM_REDIRECT_URL: "<REDIRECT_URL>"
+      EMBER_ACMIDM_LOGOUT_URL: "<LOGOUT_URL>"
+      EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal"
+      EMBER_ENGLISH_ACCOUNTS_MODEL: true
     labels:
       - "logging=true"
     restart: always

scripts/project/config.json

@@ -48,21 +48,6 @@
       "mounts": {
         "app": "/data/app/"
       }
-    },
-    {
-      "documentation": {
-        "command": "generate-dashboard-login",
-        "description": "generate a login account for the jobs dashboard",
-        "arguments": []
-      },
-      "environment": {
-        "image": "ruby",
-        "interactive": true,
-        "script": "generate-dashboard-login/run.sh"
-      },
-      "mounts": {
-        "app": "/project/"
-      }
     }
   ]
-}
+}

scripts/project/generate-dashboard-login/run.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env ruby
-require 'bundler/inline'
-require 'yaml'
-require 'securerandom'
-require 'date'
-
-$stdout.sync = true
-print "installing dependencies..."
-gemfile do
-  source 'https://rubygems.org'
-  gem 'bcrypt'
-end
-puts "done"
-
-salt = ""
-begin
-  File.open("/project/docker-compose.override.yml") do |file|
-    config = YAML.load(file)
-    salt = config.dig("services", "dashboard-login", "environment", "MU_APPLICATION_SALT")
-    throw "invalid salt" unless salt
-   end
-rescue
-  puts "Tried to locate login salt in docker-compose.override.yml, but couldn't find it."
-  puts "Please make sure a salt is configured:"
-  puts <<EOF
-  login:
-    restart: "no"
-    environment:
-      MU_APPLICATION_SALT: "#{SecureRandom.hex}"
-EOF
-end
-
-puts "this script will generate a new user account"
-print "username: "
-STDOUT.flush
-account_name = STDIN.gets.chomp
-
-print "password: "
-STDOUT.flush
-password = STDIN.gets.chomp
-
-account_salt = SecureRandom.hex
-person_uuid = SecureRandom.uuid
-account_uuid = SecureRandom.uuid
-domain = "data.gift"
-hashed_password = BCrypt::Password.create(password + salt + account_salt)
-now = DateTime.now.xmlschema
-query = %(
-PREFIX foaf: <http://xmlns.com/foaf/0.1/>
-PREFIX people: <http://#{domain}/people/>
-PREFIX accounts: <http://#{domain}/accounts/>
-PREFIX dcterms: <http://purl.org/dc/terms/>
-PREFIX mu:      <http://mu.semte.ch/vocabularies/core/>
-PREFIX ext:      <http://mu.semte.ch/vocabularies/ext/>
-PREFIX account: <http://mu.semte.ch/vocabularies/account/>
-PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
-INSERT DATA {
-   GRAPH <http://mu.semte.ch/application> {
-     people:#{person_uuid} a foaf:Person ;
-                   foaf:name "#{account_name}";
-                   foaf:account accounts:#{account_uuid};
-                   mu:uuid "#{person_uuid}";
-                   dcterms:created "#{now}"^^xsd:datetime;
-                   dcterms:modified "#{now}"^^xsd:datetime.
-     accounts:#{account_uuid} a foaf:OnlineAccount;
-                                                   foaf:accountName "#{account_name}";
-                                                   mu:uuid "#{account_uuid}";
-                                                   account:password """#{hashed_password}""";
-                                                   account:salt "#{account_salt}";
-                                                   account:status <http://mu.semte.ch/vocabularies/account/status/active>;
-                                                   dcterms:created "#{now}"^^xsd:datetime;
-                                                   ext:sessionRole "dashboard-user";
-                                                   dcterms:modified "#{now}"^^xsd:datetime.
-}}
-)
-
-timestamp = DateTime.now.strftime("%Y%m%d%H%M%L")
-filename = "#{timestamp}-create-user-#{account_name.gsub(" ", "-")}.sparql"
-File.write("/project/config/migrations/local/#{filename}", query)
-puts "generated migration ./config/migrations/local/#{filename} for #{account_name.inspect} : #{password.inspect}"