Enable authentication with suomi.fi credentials #19

attemoi · 2024-02-29T11:00:36Z

Description

Implement admin authentication via external E-kirjasto authentication application.

This implementation assumes that:

The users & roles are managed externally, not with circulation.
The system will have only one library, so the external users will be mapped as site-wide admins. See table below.

Role mapping

Circulation admin role	E-kirjasto role	Description (fi)	Description (en)
unauthorized	`sysadmin`	-	Internal technical role for auth E-kirjasto auth system management only
`system-admin`	`orgadmin`	E-kirjaston pääkäyttäjä	E-library main admin
`manager-all`	`admin`	Paikalliskirjaston pääkäyttäjä	Local library admin user
unauthorized	`registrant`	Paikalliskirjaston työntekijä / rekisteröijä	Local librarian user / registering agent
`librarian-all`	`librarian`	Paikalliskirjaston työntekijä / työryhmä	Local librarian user / work group
unauthorized	`customer`	Kirjaston asiakas	Patron

Restrictions for externally authenticated users

The following extra authorization rules are put in place for E-kirjasto (i.e. externally authenticated) users.

It is not possible to create / update / delete E-kirjasto users via admin UI (or API).
E-kirjasto users are omitted from the /admin/individual_admins response. Thus, under the admin UI “System Configuration” panel, E-kirjasto users are not listed.
E-kirjasto users are not authorized to see or edit password authenticated users.
E-kirjasto users cannot add or change their password
Only E-kirjasto main admin role is authorized to edit or delete libraries.

Other implementation details:

The E-kirjasto user ID is used to populate the email field for admin data model. This ID will also be shown in the admin UI in place of the e-mail. We have the user's given_name and family_name on the backend so with some extra implementation would be possible to show that in the UI instead of the ID.

The original email+password based login is still available. Also, the initial admin UI "setting up" mode is still there for creating an initial system-admin user without relying on E-kirjasto API.

New environment value ADMIN_EKIRJASTO_AUTHENTICATION_URL added for configuring the admin authentication URL.

In the test environment, a state parameter can be used to test different types of admin users. The available values are:

:T0000: Failure
:T0001: Success, Turku 853, Unverified, customer
:T0002: Success, Turku 853, Verified, customer
:T0003: Success, Helsinki 091, Verified, customer
:T0004: Success, Empty municipality, Verified, customer
:T0005: Success, Helsinki 091, Verified, customer, born 2010
:T0006: Success, Helsinki 091, Verified, registrant
:T0007: Success, Helsinki 091, Verified, admin
:T0008: Success, Helsinki 091, Verified, orgadmin
:T0009: Success, Turku 853, Verified, sysadmin
:T0010: Success, Turku 853, Verified, librarian

This state can be passed to circulation admin sign in page with a query param. For example, use http://localhost:6500/admin/sign_in?state=:T0008 to log in as a system admin.

Motivation and Context

https://jira.lingsoft.fi/browse/SIMPLYE-216 - Enable the authentication of librarians to the administration console with their suomi.fi credentials

Checklist

I have updated the documentation accordingly.
All new and existing tests passed.

sylvain-degeilh-lingsoft · 2024-03-04T10:40:36Z

4 roles / levels have been defined:

E-kirjaston pääkäyttäjä - E-library main admin
Paikalliskirjaston pääkäyttäjä - Local library admin user
Paikalliskirjaston työntekijä/rekisteröijä - Local librarian user / registering agent
Paikalliskirjaston työntekijä/työryhmä - Local librarian user / work group

Role 1 will access to the whole site (collection management, global statistics and system administration)
Role 2 will access the local statistics and local customized lane management
Role 3 does not have access
Role 4 will access the local customized lane management

The local customized lane management does not exist yet.

sylvain-degeilh-lingsoft

The role 3 (3. Paikalliskirjaston työntekijä/rekisteröijä - Local librarian user / registering agent) should be replaced with the role 4 (4. Paikalliskirjaston työntekijä/työryhmä - Local librarian user / work group).
Role 2 and role 4 won't have access to the system administration menu.
Role 4 won't have access to statistics.

sylvain-degeilh-lingsoft · 2024-03-04T10:52:09Z

api/admin/controller/sign_in.py

+        if ekirjasto_role == "orgadmin":
+            return AdminRole.SYSTEM_ADMIN
+        elif ekirjasto_role == "admin":
+            return AdminRole.SITEWIDE_LIBRARY_MANAGER


The local library manager can access the collection menu (aka left menu) with localized statistics and localized custom lanes.

As for Role 2 (aka manager-all, aka admin), users with this role can currently edit the library settings. So based on your comment we should add some logic to disallow that for the circulation manager-all role?

edit: based on discussion offline I will look into whether it makes more sense to add new roles or use extra rules for existing roles.

edit: The extra authorization rules are now in place. Decided to keep using the existing roles instead of creating new ones for E-kirjasto.

sylvain-degeilh-lingsoft · 2024-03-04T10:55:06Z

api/admin/controller/sign_in.py

+            return AdminRole.SYSTEM_ADMIN
+        elif ekirjasto_role == "admin":
+            return AdminRole.SITEWIDE_LIBRARY_MANAGER
+        elif ekirjasto_role == "registrant":


The registrant or registering agent does not have access to the UI. The role should be replaced by the equivalent to "Paikalliskirjaston työntekijä/työryhmä - Local librarian user / work group". It would have access to the left menu as well without the localized statistics, and with localized custom lanes (when available).

If I'm understanding this correctly, we might be missing a role for the work group on the E-kirjasto side? See the updated table in the pull request description.

Access for registrant now removed.

Yes, exactly, a role is missing for the work group.

New librarian role now included

attemoi · 2024-03-04T11:44:05Z

api/admin/controller/individual_admin_settings.py

+            .outerjoin(
+                AdminCredential
+            )  # Finland, don't return externally authenticated admins
+            .filter(AdminCredential.admin_id.is_(None))


Also realized that we probably don't want to show password authenticated users to externally authenticated users.

attemoi · 2024-03-04T11:51:35Z

api/admin/controller/sign_in.py

+        if ekirjasto_role == "orgadmin":
+            return AdminRole.SYSTEM_ADMIN
+        elif ekirjasto_role == "admin":
+            return AdminRole.SITEWIDE_LIBRARY_MANAGER


As for Role 2 (aka manager-all, aka admin), users with this role can currently edit the library settings. So based on your comment we should add some logic to disallow that for the circulation manager-all role?

edit: based on discussion offline I will look into whether it makes more sense to add new roles or use extra rules for existing roles.

edit: The extra authorization rules are now in place. Decided to keep using the existing roles instead of creating new ones for E-kirjasto.

Value will be either "password" or "external" depending on how the user authenticated themselves.

attemoi force-pushed the feature/simplye-216/suomifi-auth branch from 5710812 to c12a878 Compare February 29, 2024 11:06

attemoi requested review from jompu, ttuovinen and sylvain-degeilh-lingsoft February 29, 2024 11:06

attemoi force-pushed the feature/simplye-216/suomifi-auth branch 7 times, most recently from 8acdb83 to 784b38f Compare March 4, 2024 07:11

attemoi changed the title ~~Feature/simplye 216/suomifi auth~~ Feature: SIMPLYE_216, enable authentication with suomi.fi credentials Mar 4, 2024

attemoi changed the title ~~Feature: SIMPLYE_216, enable authentication with suomi.fi credentials~~ Enable authentication with suomi.fi credentials Mar 4, 2024

attemoi marked this pull request as ready for review March 4, 2024 07:13

attemoi force-pushed the feature/simplye-216/suomifi-auth branch from 784b38f to fecd6a0 Compare March 4, 2024 10:15

sylvain-degeilh-lingsoft suggested changes Mar 4, 2024

View reviewed changes

attemoi force-pushed the feature/simplye-216/suomifi-auth branch from fecd6a0 to 725bd98 Compare March 4, 2024 11:22

attemoi commented Mar 4, 2024

View reviewed changes

attemoi force-pushed the feature/simplye-216/suomifi-auth branch 4 times, most recently from 6b88bbd to 5daf1a1 Compare March 5, 2024 12:59

attemoi added 3 commits March 5, 2024 15:08

Refactor api/ekirjasto_authentication.py

2814c72

Implement e-kirjasto authentication flow for admins

e47272b

Pass authType parameter to admin UI

0bcc317

Value will be either "password" or "external" depending on how the user authenticated themselves.

attemoi force-pushed the feature/simplye-216/suomifi-auth branch from 5daf1a1 to 0bcc317 Compare March 6, 2024 12:10

attemoi requested a review from sylvain-degeilh-lingsoft March 6, 2024 14:00

sylvain-degeilh-lingsoft approved these changes Mar 6, 2024

View reviewed changes

Update ekirjasto-circulation-admin to 0.2.0

216d116

attemoi merged commit d76126c into main Mar 7, 2024
19 checks passed

attemoi deleted the feature/simplye-216/suomifi-auth branch March 7, 2024 07:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable authentication with suomi.fi credentials #19

Enable authentication with suomi.fi credentials #19

attemoi commented Feb 29, 2024 •

edited

Loading

sylvain-degeilh-lingsoft commented Mar 4, 2024

sylvain-degeilh-lingsoft left a comment

sylvain-degeilh-lingsoft Mar 4, 2024

attemoi Mar 4, 2024 •

edited

Loading

sylvain-degeilh-lingsoft Mar 4, 2024

attemoi Mar 4, 2024

attemoi Mar 4, 2024

sylvain-degeilh-lingsoft Mar 4, 2024

attemoi Mar 4, 2024

attemoi Mar 4, 2024

attemoi Mar 4, 2024 •

edited

Loading

Enable authentication with suomi.fi credentials #19

Enable authentication with suomi.fi credentials #19

Conversation

attemoi commented Feb 29, 2024 • edited Loading

Description

Role mapping

Restrictions for externally authenticated users

Other implementation details:

Motivation and Context

Checklist

sylvain-degeilh-lingsoft commented Mar 4, 2024

sylvain-degeilh-lingsoft left a comment

Choose a reason for hiding this comment

sylvain-degeilh-lingsoft Mar 4, 2024

Choose a reason for hiding this comment

attemoi Mar 4, 2024 • edited Loading

Choose a reason for hiding this comment

sylvain-degeilh-lingsoft Mar 4, 2024

Choose a reason for hiding this comment

attemoi Mar 4, 2024

Choose a reason for hiding this comment

attemoi Mar 4, 2024

Choose a reason for hiding this comment

sylvain-degeilh-lingsoft Mar 4, 2024

Choose a reason for hiding this comment

attemoi Mar 4, 2024

Choose a reason for hiding this comment

attemoi Mar 4, 2024

Choose a reason for hiding this comment

attemoi Mar 4, 2024 • edited Loading

Choose a reason for hiding this comment

attemoi commented Feb 29, 2024 •

edited

Loading

attemoi Mar 4, 2024 •

edited

Loading

attemoi Mar 4, 2024 •

edited

Loading