Support OAuth2 authentication for LiveDocument PDF view #5

New issue

Closed

opened 2021-11-04 22:02:20 +01:00 by hansegucker · 7 comments

hansegucker commented

2021-11-04 22:02:20 +01:00

Owner

This includes the following items:

Secure an API view with OAuth2
Provide scopes for all live documents
Check OAuth2 scopes in API view

This includes the following items: - [x] Secure an API view with OAuth2 - [x] Provide scopes for all live documents - [ ] Check OAuth2 scopes in API view

hansegucker commented

2021-11-04 22:02:21 +01:00

Author

Owner

assigned to @hansegucker

hansegucker commented

2021-11-04 22:02:33 +01:00

Author

Owner

marked the checklist item Secure an API view with OAuth2 as completed

marked the checklist item **Secure an API view with OAuth2** as completed

hansegucker commented

2021-11-04 22:02:34 +01:00

Author

Owner

marked the checklist item Provide scopes for all live documents as completed

marked the checklist item **Provide scopes for all live documents** as completed

hansegucker commented

2021-11-04 22:02:48 +01:00

Author

Owner

created merge request !44 to address this issue

hansegucker commented

2021-11-04 22:02:49 +01:00

Author

Owner

mentioned in merge request !44

nik commented

2021-11-04 23:22:32 +01:00

Owner

I have prepared an MR that allows limiting scopes per app: AlekSIS/official/AlekSIS-Core!782

That means you can now simply rely on scopes being properly filtered already when they hit your permission check.

Please test this, after the changes land in core:

Verify that using an app that is notlimited can access the resource
Verify that using an app that is limited, and has the desired scope, can access the resource
Verify that using an app that is limited, but not for the desired resource, can not access the resouce

I have prepared an MR that allows limiting scopes per app: AlekSIS/official/AlekSIS-Core!782 That means you can now simply rely on scopes being properly filtered already when they hit your permission check. Please test this, after the changes land in core: * Verify that using an app that is notlimited can access the resource * Verify that using an app that is limited, and has the desired scope, can access the resource * Verify that using an app that is limited, but not for the desired resource, can not access the resouce

nik closed this issue

2021-11-06 21:55:40 +01:00

nik commented

2021-11-06 21:55:41 +01:00

Owner

mentioned in commit 243fe08114

mentioned in commit 243fe08114f30854e358c5d16e68e98a2e45ee1e