fix(auth): use anonymous endpoint if user has wrong IDM roles
Using the anonymous as fallback endpoint prevents 403 errors of the Apiman Manager REST API if the user has not the required IDM roles of Apiman.
Closes:
MODIFY
src/app/guards/auth.guard.ts
src/app/guards/auth.guard.ts
@@ -21,6 +21,7 @@ import { KeycloakHelperService } from '../services/keycloak-helper/keycloak-help
import { PermissionsService } from '../services/permissions/permissions.service';
import { ConfigService } from '../services/config/config.service';
import { SnackbarService } from '../services/snackbar/snackbar.service';
+import { hasRequiredAuthRoles } from '../shared/utility';
@Injectable({
providedIn: 'root'
@@ -45,7 +46,7 @@ export class AuthGuard extends KeycloakAuthGuard {
});
}
- if (!this.hasRequiredRoles()) {
+ if (!hasRequiredAuthRoles(this.config.getBackendRoles(), this.roles)) {
// TODO: change to error page
this.snackbar.showErrorSnackBar('Not enough permission');
return this.router.createUrlTree(['/home']);
@@ -57,19 +58,4 @@ export class AuthGuard extends KeycloakAuthGuard {
return this.authenticated;
}
-
- /**
- * Checks if the user has all required roles, Apiman users and admins with the default roles also pass
- * @returns True if the user has one of the configured roles or if the user is a full Apiman user (based on IDM default roles)
- */
- private hasRequiredRoles() {
- const apimanAdminFallback: string[] = ['apiuser', 'apiadmin'];
- const requiredRoles = this.config.getBackendRoles();
-
- return (
- requiredRoles.every((role: string) => this.roles.includes(role)) ||
- (this.roles.includes('view-profile') &&
- apimanAdminFallback.some((role: string) => this.roles.includes(role)))
- );
- }
}

MODIFY
src/app/services/backend/backend.service.ts
src/app/services/backend/backend.service.ts
@@ -47,6 +47,7 @@ import { IPolicyProbe } from '../../interfaces/IPolicy';
import { switchMap } from 'rxjs/operators';
import { KeycloakService } from 'keycloak-angular';
import { IUrlPath } from '../../interfaces/IUrlPath';
+import { hasRequiredAuthRoles } from '../../shared/utility';
@Injectable({
providedIn: 'root'
@@ -498,7 +499,13 @@ export class BackendService {
public generateUrlFromIUrlPath(path: IUrlPath): Observable<string> {
return from(this.keycloakService.isLoggedIn()).pipe(
switchMap((loggedIn: boolean) => {
- if (loggedIn) {
+ if (
+ loggedIn &&
+ hasRequiredAuthRoles(
+ this.configService.getBackendRoles(),
+ this.keycloakService.getUserRoles()
+ )
+ ) {
return of(this.generateUrlFromPath(path.loggedInUrlPath));
}
return of(this.generateUrlFromPath(path.urlPath));

MODIFY
src/app/shared/utility.ts
src/app/shared/utility.ts
@@ -58,3 +58,23 @@ export function removeCssClass(selctor: string, className: string): void {
element.classList.remove(className);
});
}
+
+/**
+ * Checks if the user has all required roles, Apiman users and admins with the default roles also pass
+ *
+ * @param requiredRoles - string array of roles a user must have
+ * @param actualRoles - string array of roles a user currently has
+ * @returns True if the user has one of the configured roles or if the user is a full Apiman user (based on IDM default roles)
+ */
+export function hasRequiredAuthRoles(
+ requiredRoles: string[],
+ actualRoles: string[]
+) {
+ const apimanAdminFallback: string[] = ['apiuser', 'apiadmin'];
+
+ return (
+ requiredRoles.every((role: string) => actualRoles.includes(role)) ||
+ (actualRoles.includes('view-profile') &&
+ apimanAdminFallback.some((role: string) => actualRoles.includes(role)))
+ );
+}

fix(auth): use anonymous endpoint if user has wrong IDM roles

Using the anonymous as fallback endpoint prevents 403 errors of the Apiman Manager REST API if the user has not the required IDM roles of Apiman.

Closes: #132