Support OAuth2 authentication for LiveDocument PDF view #5

New issue

Closed

opened 2021-11-04 22:02:20 +01:00 by hansegucker · 7 comments

hansegucker commented

2021-11-04 22:02:20 +01:00

(Migrated from edugit.org)

This includes the following items:

Secure an API view with OAuth2
Provide scopes for all live documents
Check OAuth2 scopes in API view

This includes the following items: - [x] Secure an API view with OAuth2 - [x] Provide scopes for all live documents - [ ] Check OAuth2 scopes in API view

hansegucker commented

2021-11-04 22:02:21 +01:00

(Migrated from edugit.org)

assigned to @hansegucker

hansegucker commented

2021-11-04 22:02:33 +01:00

(Migrated from edugit.org)

marked the checklist item Secure an API view with OAuth2 as completed

marked the checklist item **Secure an API view with OAuth2** as completed

hansegucker commented

2021-11-04 22:02:34 +01:00

(Migrated from edugit.org)

marked the checklist item Provide scopes for all live documents as completed

marked the checklist item **Provide scopes for all live documents** as completed

hansegucker commented

2021-11-04 22:02:48 +01:00

(Migrated from edugit.org)

created merge request !44 to address this issue

hansegucker commented

2021-11-04 22:02:49 +01:00

(Migrated from edugit.org)

mentioned in merge request !44

nik commented

2021-11-04 23:22:32 +01:00

(Migrated from edugit.org)

I have prepared an MR that allows limiting scopes per app: AlekSIS/official/AlekSIS-Core!782

That means you can now simply rely on scopes being properly filtered already when they hit your permission check.

Please test this, after the changes land in core:

Verify that using an app that is notlimited can access the resource
Verify that using an app that is limited, and has the desired scope, can access the resource
Verify that using an app that is limited, but not for the desired resource, can not access the resouce

I have prepared an MR that allows limiting scopes per app: AlekSIS/official/AlekSIS-Core!782 That means you can now simply rely on scopes being properly filtered already when they hit your permission check. Please test this, after the changes land in core: * Verify that using an app that is notlimited can access the resource * Verify that using an app that is limited, and has the desired scope, can access the resource * Verify that using an app that is limited, but not for the desired resource, can not access the resouce

nik (Migrated from edugit.org) closed this issue

2021-11-06 21:55:40 +01:00

nik commented

2021-11-06 21:55:41 +01:00

(Migrated from edugit.org)

mentioned in commit 243fe08114

mentioned in commit 243fe08114f30854e358c5d16e68e98a2e45ee1e