How to load models based on user roles?

Data Services
,
1

I want to load models based on user roles. For example:

  • Users who have the ADMIN_A role can only load DomainA
  • Users who have the ADMIN_B role can only load DomainB

As I know in A12 data services, if users have the “Model Read” permission scope, they can load all models (no matter what role annotations in the domain model). But my project’s requirement is to load models based on custom roles. How can I deal with this?

2

Hi @cuong-wintry-haze,

Data Services supports only role-based authorization where the roles of the user must match the roles of the model. So this means that ADMIN_A role needs to have permission MODEL_READ assigned to it AND ADMIN_A role needs to be assigned also to model DomainA.

If a user does not posses ADMIN_A role will try to load DomainA model. (s)he will not be allowed to do that.

Answer valid for Data services versions 35.0.0-

3

Moin @cnnguyen,
this sounds a bit like the default authorization of Data Services is not applied.
Please check the following documentation, and if present check how additional authorizationDefinition files are integrated in your project.

https://docs.geta12.com/docs/?release=2021.06#content:asciidoc,product:UAA,artifact:uaa-documentation-src,scene:UAA,anchor:authorization-configuration

Use ‘mgm.uaa.authorization.additionalDefinitionResources’ for additional added authorization rules.

5

Hi @jan-static-daemon,
As I see in the ModelPersisterService, the hasUAAPermission method only passes the scope. How could I write the rules in the authorization JSON file to compare the user role with the role annotation in model?

@Override
@PreAuthorize("hasUAAPermission('Model Read')")
public String getModel(@SecuredObject ModelHeaderWithRoles header) {
	return getModelPersister(header).read(header);
}