UAA: Reload Authorization rules?

UAA
1

The docs say it is possible to live reload the authorization definitions: GetA12 Login

My small app is based on the project template.
I tried this using the IDEA http client:

### Login admin user
POST {{baseUrl}}/api/user/local/login
Content-Type: application/json

{
  "username": "admin",
  "password": "123456"
}

> {%
    client.global.set("access_token", response.headers.valueOf("access_token"));
%}

### Reload childAuthorizationDefinition
GET {{baseUrl}}/uaa-authorization/reloadRules
Authorization: UAABEARER {{access_token}}

###

The login request works, and I see that the access token is stored.

But what I get from second endpoint is a 500 response (Internal Server Error) with the message
An Authentication object was not found in the SecurityContext.
(I guessed the HTTP method (GET) - it’s not documented AFAICS, but POST/PUT give “Method Not Allowed”.)

What am I doing wrong?

Would be so helpful when developing my authorization rules to not have to re-start the app each time!

2

hi @stephen-warm-graph

We have endpoint to reload authorization rules. Here is documentation: GetA12 Login

Hope this helps.

3

Thanks for the answer, but please ready my question fully :wink:
That is exactly the same documentation link that I already included in the question.

I am calling exactly that endpoint (AFAICS), but I’m getting a strange error.

4

the reload rules requires:

  • User is authenticated.
  • User privilege full-fill scope Reload Rules

From your code, the user already has token therefore it’s authenticated. So I guess next step is define a permission for Reload Rules scope. The permission looks like this example:

       {
			"name": "Reload Authorization Rules",
			"description": "",
			"policy-refs": [
				"Admin policy"
			],
			"scopes": [
				"Reload Rules"
			]
		}

Also define a policy named Admin policy as well.

Hope this helps.

5

Thanks for the answer and your additional help in the chat!!!

I indeed missed the configuration of the “Reload rules” scope.

However, the a12 project template is missing some configuration to make this work during development:
It already includes

mgmtp.a12.uaa.authentication.context-path=${mgmtp.a12.dataservices.server.context-path} (which moves the authentication filters to the “/api” path)

but there is a separate configuration in uaa for the rest endpoints, which is missing in the project template:
mgmtp.a12.uaa.authorization.web.context-path=${mgmtp.a12.dataservices.server.context-path}

(So in effect without the latter configuration, the reload endpoint is at “/uaa-authorization/reloadRules” and always arrives at the controller unauthorized, because the authorizatrion is only done on “/api”.)

6

Moin @stephen-warm-graph,
thanks for pointing it out.

We will check if this should be included in the A12 Project Template out-of-the-box. But as far as I can tell right now, we are really missing this config.

Kind regards,
Jan