From aba5674e80a757d034e8159f62d2f9ad8bf9cf43 Mon Sep 17 00:00:00 2001 From: Eugenio Romano Date: Wed, 6 Mar 2019 09:53:43 +0000 Subject: [PATCH] [ADF-3735] SSO Role guard and Login error improvement (#4377) * fix lint and doc * Update auth-guard-sso-role.service.md * Update auth-guard-sso-role.service.md * fix json en * restore en.json file --- demo-shell/resources/i18n/en.json | 8 +- demo-shell/src/app/app.routes.ts | 8 +- docs/core/README.md | 3 +- docs/core/auth-guard-sso-role.service.md | 57 +++++++++ lib/core/i18n/en.json | 3 +- .../login/components/login.component.html | 17 +-- .../login/components/login.component.spec.ts | 117 ++++++++++------- lib/core/login/components/login.component.ts | 34 +++-- .../auth-guard-sso-role.service.spec.ts | 119 ++++++++++++++++++ .../services/auth-guard-sso-role.service.ts | 82 ++++++++++++ lib/core/services/authentication.service.ts | 7 ++ lib/core/services/public-api.ts | 1 + 12 files changed, 387 insertions(+), 69 deletions(-) create mode 100644 docs/core/auth-guard-sso-role.service.md create mode 100644 lib/core/services/auth-guard-sso-role.service.spec.ts create mode 100644 lib/core/services/auth-guard-sso-role.service.ts diff --git a/demo-shell/resources/i18n/en.json b/demo-shell/resources/i18n/en.json index f6aa850fcd..dca6df9a7e 100644 --- a/demo-shell/resources/i18n/en.json +++ b/demo-shell/resources/i18n/en.json @@ -311,9 +311,9 @@ } }, "SETTINGS_CLOUD": { - "MULTISELECTION": "Multiselection", - "TESTING_MODE": "Testing Mode", - "SELECTION_MODE": "Selection Mode", - "TASK_DETAILS_REDIRECTION": "Display task details on task click" + "MULTISELECTION": "Multiselection", + "TESTING_MODE": "Testing Mode", + "SELECTION_MODE": "Selection Mode", + "TASK_DETAILS_REDIRECTION": "Display task details on task click" } } diff --git a/demo-shell/src/app/app.routes.ts b/demo-shell/src/app/app.routes.ts index 95f89b1ffa..99e0abbf53 100644 --- a/demo-shell/src/app/app.routes.ts +++ b/demo-shell/src/app/app.routes.ts @@ -17,7 +17,7 @@ import { ModuleWithProviders } from '@angular/core'; import { RouterModule, Routes } from '@angular/router'; -import { AuthGuard, AuthGuardEcm, ErrorContentComponent, AuthGuardBpm } from '@alfresco/adf-core'; +import { AuthGuard, AuthGuardEcm, ErrorContentComponent, AuthGuardBpm, AuthGuardSsoRoleService } from '@alfresco/adf-core'; import { AppLayoutComponent } from './components/app-layout/app-layout.component'; import { LoginComponent } from './components/login/login.component'; import { HomeComponent } from './components/home/home.component'; @@ -143,6 +143,8 @@ export const appRoutes: Routes = [ }, { path: 'cloud', + canActivate: [AuthGuardSsoRoleService], + data: { roles: ['ACTIVITI_USER'], redirectUrl: '/error/403'}, children: [ { path: '', @@ -359,6 +361,10 @@ export const appRoutes: Routes = [ path: 'error/:id', component: ErrorContentComponent }, + { + path: 'error/no-authorization', + component: ErrorContentComponent + }, { path: '**', redirectTo: 'error/404' diff --git a/docs/core/README.md b/docs/core/README.md index 251f8282b0..25862ad747 100644 --- a/docs/core/README.md +++ b/docs/core/README.md @@ -103,7 +103,8 @@ for more information about installing and using the source code. | [Apps process service](apps-process.service.md) | Gets details of the Process Services apps that are deployed for the user. | [Source](../../lib/core/services/apps-process.service.ts) | | [Auth guard bpm service](auth-guard-bpm.service.md) | Adds authentication with Process Services to a route within the app. | [Source](../../lib/core/services/auth-guard-bpm.service.ts) | | [Auth guard ecm service](auth-guard-ecm.service.md) | Adds authentication with Content Services to a route within the app. | [Source](../../lib/core/services/auth-guard-ecm.service.ts) | -| [Auth guard service](auth-guard.service.md) | Adds authentication to a route within the app. | [Source](../../lib/core/services/auth-guard.service.ts) | +| [Auth guard service](auth-guard.service.md) | Adds authentication to a route within the app. | [Source](../../lib/core/services/auth-guard.service.ts) +| [Auth guard SSO Role service](auth-guard-sso-role.service.md) | check the roles on a user | [Source](../../lib/core/services/auth-guard-sso-role.service.ts) | | [Authentication service](authentication.service.md) | Provides authentication to ACS and APS. | [Source](../../lib/core/services/authentication.service.ts) | | [Comment content service](comment-content.service.md) | Adds and retrieves comments for nodes in Content Services. | [Source](../../lib/core/services/comment-content.service.ts) | | [Comment process service](comment-process.service.md) | Adds and retrieves comments for task and process instances in Process Services. | [Source](../../lib/core/services/comment-process.service.ts) | diff --git a/docs/core/auth-guard-sso-role.service.md b/docs/core/auth-guard-sso-role.service.md new file mode 100644 index 0000000000..7669f975c7 --- /dev/null +++ b/docs/core/auth-guard-sso-role.service.md @@ -0,0 +1,57 @@ +--- +Title: Auth Guard SSO Role service +Added: v3.1.0 +Status: Active +--- + +# [Auth Guard SSO role service](../../lib/core/services/auth-guard-sso-role.service.ts "Defined in auth-guard-sso-role.service.ts") + +Allow to check the user roles of a user + +## Details + +The Auth Guard SSO role service implements an Angular +[route guard](https://angular.io/guide/router#milestone-5-route-guards) +to check the user has the right role permission. This is typically used with the +`canActivate` guard check in the route definition. The roles that user needs to have in order to access the route has to be specified in the roles array as in the example below: + + +```ts +const appRoutes: Routes = [ + ... + { + path: 'examplepath', + component: ExampleComponent, + canActivate: [ AuthGuardSsoRoleService ], + data: { roles: ['USER_ROLE1', 'USER_ROLE2']} + }, + ... +] +``` + +If the user now clicks on a link or button that follows this route, they will be not able to access to this content if the user does not have the roles. + +## Redirect over forbidden + +If the you want to redirect the user to a different page over a forbidden error you can use the **redirectUrl** as the example below: + +```ts +const appRoutes: Routes = [ + ... + { + path: 'examplepath', + component: ExampleComponent, + canActivate: [ AuthGuardSsoRoleService ], + data: { roles: ['ACTIVITI_USER'], redirectUrl: '/error/403'} + }, + ... +] +``` + +Note: you can use this Guard in and with the other ADF auth guard. + +## See also + +- [Auth guard ecm service](auth-guard-ecm.service.md) +- [Auth guard bpm service](auth-guard-bpm.service.md) +- [Auth guard service](auth-guard.service.md) diff --git a/lib/core/i18n/en.json b/lib/core/i18n/en.json index 7597a6c54a..243c197156 100644 --- a/lib/core/i18n/en.json +++ b/lib/core/i18n/en.json @@ -210,7 +210,8 @@ "LOGIN-ERROR-PROVIDERS": "Providers cannot be undefined", "LOGIN-ERROR-CORS": "CORS exception, check your server configuration", "LOGIN-ERROR-CSRF": "CSRF exception, set [disableCsrf]=\"true\" in login.component", - "LOGIN-ECM-LICENSE": "Alfresco Content Services repository is in read-only mode" + "LOGIN-ECM-LICENSE": "Alfresco Content Services repository is in read-only mode", + "SSO-WRONG-CONFIGURATION": "SSO Authentication server unreachable" }, "BUTTON": { "LOGIN": "SIGN IN", diff --git a/lib/core/login/components/login.component.html b/lib/core/login/components/login.component.html index 71bb7023b8..4e9ee9bb99 100644 --- a/lib/core/login/components/login.component.html +++ b/lib/core/login/components/login.component.html @@ -21,15 +21,16 @@ -
- -
-
- warning - -
+ +
+
+ warning +
+
+ +