How to configure roles for user?

UAA
1

Hey,
in my roles.yaml file (usage of this file is configured in the property mgmtp.a12.uaa.authentication.user.access-rights-resource) I would like to be able to define a global permission for a role to be able to e.g. read all models. When I simply define a new role, I would expect everything to work out of the box, when I apply this new role to users:

roles.yaml

roles:
...
  - name: applicant
    description: applicant role
    accessRights:
      - DOCUMENT_READ
      - DOCUMENT_WRITE
      - MODEL_READ

The role gets applied to the user in my implementation of SamlAssertionExtractor:

extractAssertion() {
    ...
    return ExtendedUser(...,listOf(SimpleGrantedAuthority("applicant")),...)
}

But it turns out not to be the case. The rule ‘User Right Model Read’ in the default authorizationDefinition.json prohibits this:

Checking permission [Model Load Permissions] in context[1079403850]
...Level 0 for expression containsAnyRole(#resource.objectRoles) && hasAccessRight('MODEL_READ') context[1079403850]
...Executed expression[containsAnyRole(#resource.objectRoles) && hasAccessRight('MODEL_READ')] => [false] in context[1079403850]
...Level 0 for expression (false) context[1079403850]
...Executed expression[(false)] => [false] in context[1079403850]
Permission [Model Load Permissions] result is [false] in context[1079403850]
Policies [User Right Model Read] in Permission {Model Load Permissions} have failed

I assumed hasAccessRight() checks the access rights in the roles.yaml, so I overwrote the main authorization definition to only check for hasAccessRight, but I still get an error:

Checking permission [Model Load Permissions] in context[2052741148]
...Level 0 for expression hasAccessRight('MODEL_READ') context[2052741148]
Missing property [accessRights] on object [org.springframework.security.core.authority.SimpleGrantedAuthority]
...Executed expression[hasAccessRight('MODEL_READ')] => [false] in context[2052741148]
...Level 0 for expression (false) context[2052741148]
...Executed expression[(false)] => [false] in context[2052741148]
Permission [Model Load Permissions] result is [false] in context[2052741148]

Where I am going wrong with this?

2

Hello, access rights used in DS are documented in GetA12 Login

user’s rola also has to match the role in the model annotations.

But the authorization and definition of the roles is part of the UAA project, so you can ask them howto configure roles and policies.

3

I got this finally working, here my solution:

  1. I overwrote the main authorization definition to only check for hasAccessRight, so that I don’t need to annotate all models
  2. Instead of implementing my own SamlAssertionExtractor I initialized a bean of UAASamlAssertionExtractor, so that I can set the userNameProperty (as this can’t be defined via properties, even though getA12 tells you so by using mgmtp.a12.uaa.authentication.saml.assertion-user-property, but it did not work)
  3. To assign the user the role on login I implemented a SamlGrantedAuthorityConverter, to create a role I used com.mgmtp.a12.uaa.authentication.user.Role.Builder(<rolename as string>).build()
  4. To apply my own extendedUserData to the user I implemented a UserDataProcessor, where I created my own user data object based from the assertions I’ve got in the payload

With this now the rights validation works fine (to e.g. load a document+form model) and all important user attributes can be read from the SecurityContextHolder