POC on permissions for account management

[exalate-issue-sync]

As a service provider I want the account management (API/UI) to only be accessible by users that have the respective role.

• MVP requirement: one permission "Manage accounts" that comprises all the functionality around accounts, e.g., users and groups (list, create, delete, enable/disable, etc.).

  • Protect API
  • Protect UI

• Find out how to do it => POC

• Meets DoD? => Show in reviews

• Doesn't meed DoD? => Create follow-up tasks, schedule next sprint

• Not an EOS MVP blocker

[exalate-issue-sync]

Benedikt Kulmann commented: [~pmaier] Can you please elaborate/refine? At least a list of desired permissions is required to estimate story points for this story. I can take care of creating subtasks after that.

[exalate-issue-sync]

Patrick Maier commented: Let's start with one permission "Manage accounts" that comprises all the functionality around accounts, e.g., users and groups (list, create, delete, enable/disable, etc.).

[exalate-issue-sync]

Remote key is https://jira.owncloud.com/browse/OCIS-82

[exalate-issue-sync]

Benedikt Kulmann commented: Important note: implementation for this will break the existing accounts cli, as it will enforce permission checks, since the accounts cli is doing gRPC calls and has no user context.

cc [~ineumann]

[exalate-issue-sync]

Benedikt Kulmann commented: I managed to build an http middleware for ocis-accounts, which checks the roles of the authenticated user + the service handler from the request against a permission endpoint from ocis-settings. Making pull requests to ocis-accounts, ocis-settings, ocis-pkg and ocis-proxy tomorrow morning.

[exalate-issue-sync]

Benedikt Kulmann commented: PR owncloud/ocis-accounts#100 is currently blocked by failing UI tests. Reason is, that ocis-accounts can't talk to ocis-settings for setting roles of the builtin default users, thus failing to create them at all.

[exalate-issue-sync]

Benedikt Kulmann commented: PR is owncloud/ocis#505

[exalate-issue-sync]

Benedikt Kulmann commented: We moved parts of this story into a new story: https://jira.owncloud.com/browse/OCIS-443