Merge branch 'develop' into stable (9412957e) · Commits · Inteligr8 / auth-activiti-app-ext

README.md

+47 −38

Original line number	Diff line number	Diff line
		# Auth Extension for APS (Activiti App)

		This library was originally created to expand the functionality of Keycloak integration within the Alfresco Process Services (APS) application. It has expanded to support general OAuth, closing gaps that remain in the implementation provided by Alfresco. This is useless for the open source Activiti.
		This library was originally created to expand the functionality of Keycloak integration within the Alfresco Process Services (APS) application. It has expanded to support general OAuth, closing gaps that remain in the implementation provided by Alfresco. This is useless for the open source Activiti product.

		APS delivers SSO capability and that is about it. It has a few shortcomings:

		@@ -9,6 +9,8 @@ APS delivers SSO capability and that is about it. It has a few shortcomings:

		This extension aims to resolve those issues.

		The older version of this extension was specific to Keycloak and was named `keycloak-activiti-app-ext`. See the [`develop-v1.4.x` branch](https://git.inteligr8.com/inteligr8/auth-activiti-app-ext/src/branch/develop-v1.4.x/) for details specific to it.

		## Installation

		The installation is simple. Just include the JAR in the classpath of your APS application. This is best done by not chaning the `activiti-app.war` file, but instead including it within the classpath using your web container configuration. For Apache Tomcat, you would add or modify the following context file: `conf/Catalina/localhost/activiti-app.xml`. Its related contents would be:
		@@ -35,11 +37,11 @@ This extension requires the [`multiext-activiti-app-ext`](https://git.inteligr8.

		## Support Matrix

		\| Auth Activiti App Extension \| Activiti App \|
		\| --------------------------- \| --------------- \|
		\| v1.0 - v1.2 \| v1.11.x \|
		\| v1.3 \| v1.11.x - v2.x \|
		\| v2.0+ \| v24.x+ \|
		\| Activiti App Extension \| Activiti App \|
		\| --------------------------------------- \| --------------- \|
		\| `keycloak-activiti-app-ext` v1.0 - v1.2 \| v1.11.x \|
		\| `keycloak-activiti-app-ext` v1.3 - v1.4 \| v1.11.x - v2.x \|
		\| `auth-activiti-app-ext` v2.0+ \| v24.x+ \|

		## Configuration

		@@ -47,6 +49,13 @@ The library is highly configurable. You configure it with properties specified

		This will only work if OAuth is being used. That would be the case if `activiti.identity-service.enabled` or `security.oauth2.authentication.enabled` is `true`.

		The following properties are used across the functionalities of this extension.

		\| Property \| Default \| Description \|
		\| --------------------------------- \| --------- \| ----------- \|
		\| `auth-ext.externalId` \| `oauth` \| This will serve as the external ID for users and as the prefix for the external ID of groups created or searched by this extension. Anything without an external ID is considered internal. So mismatched external IDs are never considered for anything by this extension. \|
		\| `auth-ext.tenant` \| \| A preselected tenant for all operations in this extension. Only required if there are multiple tenants. \|

		### OAuth Authentication/Authorization

		The following properties were added to increase the configurability of the built-in OAuth capabilities of APS. The default in this extension adds the `microprofile-jwt` scope, which is key to providing groups/roles/entitlements.
		@@ -60,11 +69,9 @@ The following properties were added to increase the configurability of the built
		The following properties provide the core functionality of this extension. That is role synchronization.

		\| Property \| Default \| Description \|
		\| ---------------------------------------------- \| --------- \| ----------- \|
		\| `auth-ext.externalId` \| `oauth` \| This will serve as the external ID for users and as the prefix for the external ID of groups created by this extension. \|
		\| `auth-ext.tenant` \| \| A preselected tenant for all operations in this extension. Only required if there are multiple tenants. \|
		\| --------------------------------------------- \| ------------ \| ----------- \|
		\| `auth-ext.sync.user.createMissing` \| `true` \| If the user is authenticated, the user may be created in APS. \|
		\| `auth-ext.sync.user.requireGroup` \| \| This is only applicable when `createMissing` is `true`. If this is unset or the OAuth Authorization Server gives the user the specified group/role, then the user record will be created in APS. \|
		\| `auth-ext.sync.user.requireOidcGroup` \| \| This is only applicable when `createMissing` is `true`. If this is unset or the OAuth Authorization Server gives the user the specified group/role, then the user record will be created in APS. \|
		\| `auth-ext.sync.user.clearNewUserGroups` \| `true` \| This is only applicable when `createMissing` is `true`. All default APS groups will be deleted from the new user record. \|
		\| `auth-ext.sync.group.createMissing` \| `true` \| If a filtered and translated OIDC group has no corresponding APS group, a group will be created in APS. See `auth-ext.sync.group.capabilities.patterns` for whether that group will be an APS Organization or APS Capability. \|
		\| `auth-ext.sync.group.additions` \| `true` \| If the user isn't in an APS group but OAuth claims the OIDC group, then add them to it. \|
		@@ -72,35 +79,37 @@ The following properties provide the core functionality of this extension. That
		\| `auth-ext.sync.group.internal` \| `false` \| When considering groups for creation or user membership, include internal groups. Internal groups are ones without an `externalId`. \|
		\| `auth-ext.sync.group.internal.externalize` \| `false` \| This is only applicable when `internal` is `true`. If an internal group is encountered during the operation of this extension, make it external with the current `externalId`. \|
		\| `auth-ext.sync.group.tenantize` \| `false` \| If a group without a tenant is encountered during the operation of this extension, make it part of the selected tenant. \|
		\| `auth-ext.sync.group.translate.patterns` \| \| A comma delimited set of regular expression patterns for the translation (reformatting) of authorities. \|
		\| `auth-ext.sync.group.translate.replacements` \| \| A comma delimited set of regular expression replacement strings for the translation (reformatting) of authorities. \|
		\| `auth-ext.sync.group.include.patterns` \| \| A comma delimited set of regular expression patterns on what authorities to include. This is processed before `translate` processing. A blank value includes everything. If anything is specified, then only matches could possibly be included; but could still be excluded explicitly. \|
		\| `auth-ext.sync.group.exclude.patterns` \| \| A comma delimited set of regular expression patterns on what authorities to exclude. This is processed before `translate` processing. A blank value excludes nothing. If anything is specified and `include` is empty, then only matches will be excluded. If both are specified, `exclude` overrules `include` matches. \|
		\| `auth-ext.sync.group.capabilities.patterns` \| `Superusers` \| A comma delimited set of regular expression patterns on what authorities to associate with APS Capabilities instead of APS Organizations (default). \|

		\| `auth-ext.sync.group.include.patterns` \| \| A comma delimited set of regular expression patterns on what OIDC groups to include. This is processed before `translate` processing. A blank value matches everything. If anything is specified, then only matches could possibly be included. Any matches of the `exclude` property patterns always override though. \|
		\| `auth-ext.sync.group.exclude.patterns` \| \| A comma delimited set of regular expression patterns on what OIDC groups to exclude. This is processed before `translate` processing. A blank value matches nothing (includes all that pass the `include` constraint). If anything is specified and `include` is empty, then all non-matches are included. If both are specified, `exclude` matches override `include` matches. \|
		\| `auth-ext.sync.group.translate.patterns` \| \| A comma delimited set of regular expression patterns for the translation (reformatting) of OIDC groups to APS groups. This list corresponds to the `replacements` property and must have the same number of commas. \|
		\| `auth-ext.sync.group.translate.replacements` \| \| A comma delimited set of regular expression replacement strings for the translation (reformatting) of OIDC groups to APS groups. This list corresponds to the `patterns` property and must have the same number of commas. \|
		\| `auth-ext.sync.group.capability.patterns` \| `Superusers` \| A comma delimited set of regular expression patterns on what translated OIDC groups to associate with APS Capability Groups instead of APS Organization Groups (default). This is processed after `translate` processing. \|

		### Authentication Data Fixers

		#### Administrator Password Fixer

		\| Property \| Default \| Description \|
		\| ----------------------------------------- \| ------------------------ \| ----------- \|
		This fixer does not execute unless the `auth-ext.reset.admin.password` property is explicitly set. It is meant to be set for a single run to fix scenarios when a non-OAuth administrator cannot access the system. This is useful when your OAuth configuration isn't working and you need to reset your non-OAuth administrator's password.

		\| Property \| Default \|
		\| --------------------------------- \| ------------------------ \|
		\| `auth-ext.reset.admin.username` \| `admin@app.activiti.com` \|
		\| `auth-ext.reset.admin.password` \| \| If set, the user's password will be set to this value on startup; otherwise this fixer is skipped. \|
		\| `auth-ext.reset.admin.password` \| \|

		#### Administrator Members Fixer

		This fixer does not execute unless the `auth-ext.default.admin-users` property is explicitly set. It is meant to be set for a single run to add both non-OAuth and OAuth users to an administrator group. This is useful when OAuth is misconfigured and all administrators lose their administrator rights.

		\| Property \| Default \| Description \|
		\| ----------------------------------------- \| ------------------------ \| ----------- \|
		\| `auth-ext.default.admins.users` \| \| A comma delimited list of user emails; fixer is skipped if empty. \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Group (Capability or Organization) to add the specified users to. \|
		\| `auth-ext.group.admins.externalId` \| \| If specified, this APS Group will be considered before the specified `name` field. \|
		\| ------------------------------------ \| ------------ \| ----------- \|
		\| `auth-ext.default.admins.users` \| \| A comma delimited list of user emails. \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Group (Capability or Organization) for the specified users to be members. \|

		#### Administrator Group Fixer

		This fixer does not execute unless the `auth-ext.group.admins.validate` property is set to `true`. It is meant to be set for a single run to correct the specified group for administration access. This is useful if you accidentally delete the administrative APS Capability Group, typically called `Administrator` or `Superusers`.

		\| Property \| Default \| Description \|
		\| ----------------------------------------- \| ------------------------ \| ----------- \|
		\| `auth-ext.group.admins.validate` \| `false` \| If `true`, the specified APS Group will be granted all capabilities. \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Group (Capability or Organization) to add the specified users to. \|
		\| `auth-ext.group.admins.externalId` \| \| If specified, this APS Group will be considered before the specified `name` field. \|

		\| `auth-ext.group.admins.validate` \| `false` \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Capability Group of which to grant all capabilities. \|

pom.xml

+2 −1

Original line number	Diff line number	Diff line
		@@ -5,7 +5,7 @@

		<groupId>com.inteligr8.activiti</groupId>
		<artifactId>auth-activiti-app-ext</artifactId>
		<version>2.0.2</version>
		<version>2.1.0</version>

		<name>Authentication & Authorization for APS</name>
		<description>An Alfresco Process Service App extension providing improved authentication and authorization support.</description>
		@@ -45,6 +45,7 @@

		<!-- for RAD -->
		<tomcat-rad.version>10-2.2</tomcat-rad.version>
		<aps.hotswap.enabled>false</aps.hotswap.enabled>
		<aps.tomcat.opts.base>-Dspring.main.allow-circular-references=true \
		-Dhibernate.dialect=org.hibernate.dialect.PostgreSQLDialect \
		-Dauth-ext.external.id=keycloak \

src/main/java/com/inteligr8/activiti/auth/ActivitiAppAdministratorMembersFixer.java

+1 −1

Original line number	Diff line number	Diff line
		@@ -58,7 +58,7 @@ public class ActivitiAppAdministratorMembersFixer implements DataFixer {
		@Value("${auth-ext.group.admins.name:Superusers}")
		private String adminGroupName;

		@Value("${auth-ext.group.admins.externalId:#{null}}")
		@Value("${auth-ext.externalId:oauth}")
		private String adminGroupExternalId;

		@Override

src/main/java/com/inteligr8/activiti/auth/oauth/IdentityServiceConfigurationOverride.java

+34 −1

Original line number	Diff line number	Diff line
		package com.inteligr8.activiti.auth.oauth;

		import static org.springframework.security.web.util.matcher.AntPathRequestMatcher.antMatcher;

		import org.apache.commons.lang3.StringUtils;
		import org.slf4j.Logger;
		import org.slf4j.LoggerFactory;
		@@ -10,11 +12,16 @@ import org.springframework.context.annotation.Bean;
		import org.springframework.context.annotation.Conditional;
		import org.springframework.context.annotation.Configuration;
		import org.springframework.context.annotation.Primary;
		import org.springframework.core.annotation.Order;
		import org.springframework.security.config.annotation.web.builders.HttpSecurity;
		import org.springframework.security.oauth2.client.registration.ClientRegistration;
		import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
		import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
		import org.springframework.security.web.SecurityFilterChain;

		import com.activiti.security.ProtectedPaths;
		import com.activiti.security.identity.service.config.IdentityServiceEnabledCondition;
		import com.inteligr8.activiti.auth.service.JwtAuthenticationProvider;
		import com.nimbusds.oauth2.sdk.ParseException;

		/**
		@@ -33,6 +40,9 @@ public class IdentityServiceConfigurationOverride {
		@Autowired
		private ApplicationContext appContext;

		@Autowired
		private JwtAuthenticationProvider jwtAuthenticationProvider;

		@Bean("inteligr8.clientRegistrationRepository")
		@Primary
		public ClientRegistrationRepository clientRegistrationRepository() {
		@@ -51,7 +61,7 @@ public class IdentityServiceConfigurationOverride {

		@Bean(OVERRIDE_CLIENT_REGISTRATION_BEANNAME)
		@Primary
		public ClientRegistration clientRegistration1() throws ParseException, InterruptedException {
		public ClientRegistration clientRegistration() throws ParseException, InterruptedException {
		this.logger.trace("clientRegistration()");
		ClientRegistration clientRegistration = this.appContext.getBean(OOTB_CLIENT_REGISTRATION_BEANNAME, ClientRegistration.class);

		@@ -62,4 +72,27 @@ public class IdentityServiceConfigurationOverride {
		.build();
		}

		/**
		* Slightly lower priority than the one provided OOTB. This
		* allows for the bean injection of the JwtAuthenticationConverter.
		*
		* A lower priority means it is applied last. This means it replaces the
		* JwtAuthenticationConverter provided by Alfresco OOTB.
		*
		* @see com.activiti.security.identity.service.config.IdentityServiceConfigurationApi#identityServiceApiWebSecurity
		*/
		@Bean("inteligr8.identityServiceApiWebSecurity")
		@Order(-5)
		public SecurityFilterChain identityServiceApiWebSecurity(HttpSecurity http) throws Exception {
		http
		.securityMatcher(antMatcher(ProtectedPaths.API_URL_PATH + "/**"))
		.oauth2ResourceServer(oauth2 ->
		oauth2.jwt(jwtConfigurer -> {
		jwtConfigurer.jwtAuthenticationConverter(this.jwtAuthenticationProvider.create());
		})
		);

		return http.build();
		}

		}

src/main/java/com/inteligr8/activiti/auth/service/GroupSyncService.java

+49 −38

File changed.

Preview size limit exceeded, changes collapsed.

Original line number	Diff line number	Diff line
		# Auth Extension for APS (Activiti App)

		This library was originally created to expand the functionality of Keycloak integration within the Alfresco Process Services (APS) application. It has expanded to support general OAuth, closing gaps that remain in the implementation provided by Alfresco. This is useless for the open source Activiti.
		This library was originally created to expand the functionality of Keycloak integration within the Alfresco Process Services (APS) application. It has expanded to support general OAuth, closing gaps that remain in the implementation provided by Alfresco. This is useless for the open source Activiti product.

		APS delivers SSO capability and that is about it. It has a few shortcomings:

		@@ -9,6 +9,8 @@ APS delivers SSO capability and that is about it. It has a few shortcomings:

		This extension aims to resolve those issues.

		The older version of this extension was specific to Keycloak and was named `keycloak-activiti-app-ext`. See the [`develop-v1.4.x` branch](https://git.inteligr8.com/inteligr8/auth-activiti-app-ext/src/branch/develop-v1.4.x/) for details specific to it.

		## Installation

		The installation is simple. Just include the JAR in the classpath of your APS application. This is best done by not chaning the `activiti-app.war` file, but instead including it within the classpath using your web container configuration. For Apache Tomcat, you would add or modify the following context file: `conf/Catalina/localhost/activiti-app.xml`. Its related contents would be:
		@@ -35,11 +37,11 @@ This extension requires the [`multiext-activiti-app-ext`](https://git.inteligr8.

		## Support Matrix

		\| Auth Activiti App Extension \| Activiti App \|
		\| --------------------------- \| --------------- \|
		\| v1.0 - v1.2 \| v1.11.x \|
		\| v1.3 \| v1.11.x - v2.x \|
		\| v2.0+ \| v24.x+ \|
		\| Activiti App Extension \| Activiti App \|
		\| --------------------------------------- \| --------------- \|
		\| `keycloak-activiti-app-ext` v1.0 - v1.2 \| v1.11.x \|
		\| `keycloak-activiti-app-ext` v1.3 - v1.4 \| v1.11.x - v2.x \|
		\| `auth-activiti-app-ext` v2.0+ \| v24.x+ \|

		## Configuration

		@@ -47,6 +49,13 @@ The library is highly configurable. You configure it with properties specified

		This will only work if OAuth is being used. That would be the case if `activiti.identity-service.enabled` or `security.oauth2.authentication.enabled` is `true`.

		The following properties are used across the functionalities of this extension.

		\| Property \| Default \| Description \|
		\| --------------------------------- \| --------- \| ----------- \|
		\| `auth-ext.externalId` \| `oauth` \| This will serve as the external ID for users and as the prefix for the external ID of groups created or searched by this extension. Anything without an external ID is considered internal. So mismatched external IDs are never considered for anything by this extension. \|
		\| `auth-ext.tenant` \| \| A preselected tenant for all operations in this extension. Only required if there are multiple tenants. \|

		### OAuth Authentication/Authorization

		The following properties were added to increase the configurability of the built-in OAuth capabilities of APS. The default in this extension adds the `microprofile-jwt` scope, which is key to providing groups/roles/entitlements.
		@@ -60,11 +69,9 @@ The following properties were added to increase the configurability of the built
		The following properties provide the core functionality of this extension. That is role synchronization.

		\| Property \| Default \| Description \|
		\| ---------------------------------------------- \| --------- \| ----------- \|
		\| `auth-ext.externalId` \| `oauth` \| This will serve as the external ID for users and as the prefix for the external ID of groups created by this extension. \|
		\| `auth-ext.tenant` \| \| A preselected tenant for all operations in this extension. Only required if there are multiple tenants. \|
		\| --------------------------------------------- \| ------------ \| ----------- \|
		\| `auth-ext.sync.user.createMissing` \| `true` \| If the user is authenticated, the user may be created in APS. \|
		\| `auth-ext.sync.user.requireGroup` \| \| This is only applicable when `createMissing` is `true`. If this is unset or the OAuth Authorization Server gives the user the specified group/role, then the user record will be created in APS. \|
		\| `auth-ext.sync.user.requireOidcGroup` \| \| This is only applicable when `createMissing` is `true`. If this is unset or the OAuth Authorization Server gives the user the specified group/role, then the user record will be created in APS. \|
		\| `auth-ext.sync.user.clearNewUserGroups` \| `true` \| This is only applicable when `createMissing` is `true`. All default APS groups will be deleted from the new user record. \|
		\| `auth-ext.sync.group.createMissing` \| `true` \| If a filtered and translated OIDC group has no corresponding APS group, a group will be created in APS. See `auth-ext.sync.group.capabilities.patterns` for whether that group will be an APS Organization or APS Capability. \|
		\| `auth-ext.sync.group.additions` \| `true` \| If the user isn't in an APS group but OAuth claims the OIDC group, then add them to it. \|
		@@ -72,35 +79,37 @@ The following properties provide the core functionality of this extension. That
		\| `auth-ext.sync.group.internal` \| `false` \| When considering groups for creation or user membership, include internal groups. Internal groups are ones without an `externalId`. \|
		\| `auth-ext.sync.group.internal.externalize` \| `false` \| This is only applicable when `internal` is `true`. If an internal group is encountered during the operation of this extension, make it external with the current `externalId`. \|
		\| `auth-ext.sync.group.tenantize` \| `false` \| If a group without a tenant is encountered during the operation of this extension, make it part of the selected tenant. \|
		\| `auth-ext.sync.group.translate.patterns` \| \| A comma delimited set of regular expression patterns for the translation (reformatting) of authorities. \|
		\| `auth-ext.sync.group.translate.replacements` \| \| A comma delimited set of regular expression replacement strings for the translation (reformatting) of authorities. \|
		\| `auth-ext.sync.group.include.patterns` \| \| A comma delimited set of regular expression patterns on what authorities to include. This is processed before `translate` processing. A blank value includes everything. If anything is specified, then only matches could possibly be included; but could still be excluded explicitly. \|
		\| `auth-ext.sync.group.exclude.patterns` \| \| A comma delimited set of regular expression patterns on what authorities to exclude. This is processed before `translate` processing. A blank value excludes nothing. If anything is specified and `include` is empty, then only matches will be excluded. If both are specified, `exclude` overrules `include` matches. \|
		\| `auth-ext.sync.group.capabilities.patterns` \| `Superusers` \| A comma delimited set of regular expression patterns on what authorities to associate with APS Capabilities instead of APS Organizations (default). \|

		\| `auth-ext.sync.group.include.patterns` \| \| A comma delimited set of regular expression patterns on what OIDC groups to include. This is processed before `translate` processing. A blank value matches everything. If anything is specified, then only matches could possibly be included. Any matches of the `exclude` property patterns always override though. \|
		\| `auth-ext.sync.group.exclude.patterns` \| \| A comma delimited set of regular expression patterns on what OIDC groups to exclude. This is processed before `translate` processing. A blank value matches nothing (includes all that pass the `include` constraint). If anything is specified and `include` is empty, then all non-matches are included. If both are specified, `exclude` matches override `include` matches. \|
		\| `auth-ext.sync.group.translate.patterns` \| \| A comma delimited set of regular expression patterns for the translation (reformatting) of OIDC groups to APS groups. This list corresponds to the `replacements` property and must have the same number of commas. \|
		\| `auth-ext.sync.group.translate.replacements` \| \| A comma delimited set of regular expression replacement strings for the translation (reformatting) of OIDC groups to APS groups. This list corresponds to the `patterns` property and must have the same number of commas. \|
		\| `auth-ext.sync.group.capability.patterns` \| `Superusers` \| A comma delimited set of regular expression patterns on what translated OIDC groups to associate with APS Capability Groups instead of APS Organization Groups (default). This is processed after `translate` processing. \|

		### Authentication Data Fixers

		#### Administrator Password Fixer

		\| Property \| Default \| Description \|
		\| ----------------------------------------- \| ------------------------ \| ----------- \|
		This fixer does not execute unless the `auth-ext.reset.admin.password` property is explicitly set. It is meant to be set for a single run to fix scenarios when a non-OAuth administrator cannot access the system. This is useful when your OAuth configuration isn't working and you need to reset your non-OAuth administrator's password.

		\| Property \| Default \|
		\| --------------------------------- \| ------------------------ \|
		\| `auth-ext.reset.admin.username` \| `admin@app.activiti.com` \|
		\| `auth-ext.reset.admin.password` \| \| If set, the user's password will be set to this value on startup; otherwise this fixer is skipped. \|
		\| `auth-ext.reset.admin.password` \| \|

		#### Administrator Members Fixer

		This fixer does not execute unless the `auth-ext.default.admin-users` property is explicitly set. It is meant to be set for a single run to add both non-OAuth and OAuth users to an administrator group. This is useful when OAuth is misconfigured and all administrators lose their administrator rights.

		\| Property \| Default \| Description \|
		\| ----------------------------------------- \| ------------------------ \| ----------- \|
		\| `auth-ext.default.admins.users` \| \| A comma delimited list of user emails; fixer is skipped if empty. \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Group (Capability or Organization) to add the specified users to. \|
		\| `auth-ext.group.admins.externalId` \| \| If specified, this APS Group will be considered before the specified `name` field. \|
		\| ------------------------------------ \| ------------ \| ----------- \|
		\| `auth-ext.default.admins.users` \| \| A comma delimited list of user emails. \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Group (Capability or Organization) for the specified users to be members. \|

		#### Administrator Group Fixer

		This fixer does not execute unless the `auth-ext.group.admins.validate` property is set to `true`. It is meant to be set for a single run to correct the specified group for administration access. This is useful if you accidentally delete the administrative APS Capability Group, typically called `Administrator` or `Superusers`.

		\| Property \| Default \| Description \|
		\| ----------------------------------------- \| ------------------------ \| ----------- \|
		\| `auth-ext.group.admins.validate` \| `false` \| If `true`, the specified APS Group will be granted all capabilities. \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Group (Capability or Organization) to add the specified users to. \|
		\| `auth-ext.group.admins.externalId` \| \| If specified, this APS Group will be considered before the specified `name` field. \|

		\| `auth-ext.group.admins.validate` \| `false` \|
		\| `auth-ext.group.admins.name` \| `Superusers` \| The APS Capability Group of which to grant all capabilities. \|