From 8f4a0d42b8cf0563b68d88e1119efb0fdba3091a Mon Sep 17 00:00:00 2001 From: burnettk Date: Sun, 27 Nov 2022 21:07:20 -0500 Subject: [PATCH] make sasha, harmeet, manuchehr, and admin have desired permissions for demo --- .../bin/spiffworkflow-realm.json | 84 +++++++++++++------ .../config/permissions/development.yml | 11 ++- .../terraform_deployed_environment.yml | 11 ++- .../models/process_instance.py | 2 +- .../routes/process_api_blueprint.py | 4 +- .../process_instance_report_service.py | 1 - .../services/process_instance_service.py | 2 +- 7 files changed, 77 insertions(+), 38 deletions(-) diff --git a/spiffworkflow-backend/bin/spiffworkflow-realm.json b/spiffworkflow-backend/bin/spiffworkflow-realm.json index 2e8469bc..e0b7ee3f 100644 --- a/spiffworkflow-backend/bin/spiffworkflow-realm.json +++ b/spiffworkflow-backend/bin/spiffworkflow-realm.json @@ -360,6 +360,14 @@ "clientRole" : true, "containerId" : "e39b3c85-bb9d-4c73-8250-be087c82ae48", "attributes" : { } + }, { + "id" : "f75e4973-b9b6-4ff0-a691-5f900199b17a", + "name" : "view-groups", + "description" : "${role_view-groups}", + "composite" : false, + "clientRole" : true, + "containerId" : "e39b3c85-bb9d-4c73-8250-be087c82ae48", + "attributes" : { } }, { "id" : "ae774a41-a274-4f99-9d7f-f4a0d5dbc085", "name" : "view-applications", @@ -387,7 +395,8 @@ "otpPolicyDigits" : 6, "otpPolicyLookAheadWindow" : 1, "otpPolicyPeriod" : 30, - "otpSupportedApplications" : [ "FreeOTP", "Google Authenticator" ], + "otpPolicyCodeReusable" : false, + "otpSupportedApplications" : [ "totpAppGoogleName", "totpAppFreeOTPName" ], "webAuthnPolicyRpEntityName" : "keycloak", "webAuthnPolicySignatureAlgorithms" : [ "ES256" ], "webAuthnPolicyRpId" : "", @@ -409,6 +418,28 @@ "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false, "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ], "users" : [ { + "id" : "5a97144d-4f59-4a8c-b365-463d0577a740", + "createdTimestamp" : 1669600821350, + "username" : "admin", + "enabled" : true, + "totp" : false, + "emailVerified" : false, + "firstName" : "", + "lastName" : "", + "credentials" : [ { + "id" : "ef435043-ef0c-407a-af5b-ced13182a408", + "type" : "password", + "userLabel" : "My password", + "createdDate" : 1669600831704, + "secretData" : "{\"value\":\"4D4JRvE7kR5nfGiIdrwzK+0drmy3kX++TlT1BTvYix8N83c9FGTPWvxR1Hl4ggEKuCCAEYZnTzVJZY0DcUcN+A==\",\"salt\":\"yI7UkD+mCuq0H35AnNV/KA==\",\"additionalParameters\":{}}", + "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}" + } ], + "disableableCredentialTypes" : [ ], + "requiredActions" : [ ], + "realmRoles" : [ "default-roles-spiffworkflow" ], + "notBefore" : 0, + "groups" : [ ] + }, { "id" : "4048e9a7-8afa-4e69-9904-389657221abe", "createdTimestamp" : 1665517741516, "username" : "alex", @@ -2130,7 +2161,7 @@ "subType" : "authenticated", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "saml-user-attribute-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "saml-user-property-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "oidc-sha256-pairwise-sub-mapper" ] + "allowed-protocol-mapper-types" : [ "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-property-mapper", "saml-role-list-mapper", "saml-user-property-mapper", "oidc-address-mapper", "saml-user-attribute-mapper" ] } }, { "id" : "d68e938d-dde6-47d9-bdc8-8e8523eb08cd", @@ -2148,7 +2179,7 @@ "subType" : "anonymous", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "oidc-full-name-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-role-list-mapper", "oidc-usermodel-property-mapper", "oidc-usermodel-attribute-mapper", "oidc-address-mapper" ] + "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-property-mapper", "saml-role-list-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper" ] } }, { "id" : "3854361d-3fe5-47fb-9417-a99592e3dc5c", @@ -2238,7 +2269,7 @@ "internationalizationEnabled" : false, "supportedLocales" : [ ], "authenticationFlows" : [ { - "id" : "29b6cb47-f90e-4150-ad22-a51cc15e2b31", + "id" : "b30ab201-b13a-405f-bc57-cb5cd934bdc3", "alias" : "Account verification options", "description" : "Method with which to verity the existing account", "providerId" : "basic-flow", @@ -2260,7 +2291,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "7a565558-8cb9-428a-b0b0-b2b8e6e27df9", + "id" : "7d22faa2-1da8-49ae-a2cc-74e9c9f6ed51", "alias" : "Authentication Options", "description" : "Authentication options.", "providerId" : "basic-flow", @@ -2289,7 +2320,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "3399b155-d1f0-445a-b260-d606feb7927d", + "id" : "ae089cf3-3179-4e12-a683-7969a31be566", "alias" : "Browser - Conditional OTP", "description" : "Flow to determine if the OTP is required for the authentication", "providerId" : "basic-flow", @@ -2311,7 +2342,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "95c39140-3898-4376-bbde-be0063558809", + "id" : "27a21643-2167-4847-a6b4-b07007671d9a", "alias" : "Direct Grant - Conditional OTP", "description" : "Flow to determine if the OTP is required for the authentication", "providerId" : "basic-flow", @@ -2333,7 +2364,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "6eed8cb3-f5b4-4e57-b41a-a96cefee2fcf", + "id" : "0ee33ef7-da6b-4248-81c6-9f4f11b58195", "alias" : "First broker login - Conditional OTP", "description" : "Flow to determine if the OTP is required for the authentication", "providerId" : "basic-flow", @@ -2355,7 +2386,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "3c22db0a-477b-40bb-833a-46b0b69992d0", + "id" : "e1d02af3-2886-42bb-95f4-bfa6f1299edc", "alias" : "Handle Existing Account", "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider", "providerId" : "basic-flow", @@ -2377,7 +2408,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "939c4aad-e96b-4d96-ada1-49a23c645bcb", + "id" : "35cfc75f-70e3-487c-acd7-0627ab1dbdf1", "alias" : "Reset - Conditional OTP", "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.", "providerId" : "basic-flow", @@ -2399,7 +2430,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "ae08d416-c43f-4dad-a149-356c3f8ae8b9", + "id" : "cc2f7206-8d15-46db-b974-71e67d4d1077", "alias" : "User creation or linking", "description" : "Flow for the existing/non-existing user alternatives", "providerId" : "basic-flow", @@ -2422,7 +2453,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "cbea45de-9155-4b5c-a6df-d93a1ffa2621", + "id" : "d8314533-eacb-40ef-8f44-7c06321e9793", "alias" : "Verify Existing Account by Re-authentication", "description" : "Reauthentication of existing account", "providerId" : "basic-flow", @@ -2444,7 +2475,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "21f3ff6b-b2ea-4d86-9d4d-2a2d244043b4", + "id" : "d58a5ff1-9a9c-45a9-9f97-1324565e9679", "alias" : "browser", "description" : "browser based authentication", "providerId" : "basic-flow", @@ -2480,7 +2511,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "6f2dd054-9768-412d-a4d4-6333eb3f85f3", + "id" : "3ea2aed9-12d9-4999-a104-67f5c5f7841a", "alias" : "clients", "description" : "Base authentication for clients", "providerId" : "client-flow", @@ -2516,7 +2547,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "3a3681cb-5de7-4875-b90f-58d1d07e2bcd", + "id" : "c605af3c-bede-4f8f-a5c5-94176171c82c", "alias" : "direct grant", "description" : "OpenID Connect Resource Owner Grant", "providerId" : "basic-flow", @@ -2545,7 +2576,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "1c76ce4f-3419-4647-a311-3579390cced3", + "id" : "901b4d6c-9c27-4d3d-981a-1b5281c1ea2b", "alias" : "docker auth", "description" : "Used by Docker clients to authenticate against the IDP", "providerId" : "basic-flow", @@ -2560,7 +2591,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "079762a1-a1ca-4aaa-beb1-c058ea11d98a", + "id" : "9d1de1bf-b170-4235-92f1-5dfd3ec31c45", "alias" : "first broker login", "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", "providerId" : "basic-flow", @@ -2583,7 +2614,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "04e26750-5823-42b8-b56a-acce89457cb8", + "id" : "8ee6b54f-4d31-4847-9ddc-36cb4c01b92b", "alias" : "forms", "description" : "Username, password, otp and other auth forms.", "providerId" : "basic-flow", @@ -2605,7 +2636,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "564a1742-c2a0-47b6-9c19-59a8a1f9e171", + "id" : "76d3380b-218b-443d-a3ea-bea712f4a1f4", "alias" : "http challenge", "description" : "An authentication flow based on challenge-response HTTP Authentication Schemes", "providerId" : "basic-flow", @@ -2627,7 +2658,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "dd0b51b1-13de-4bf0-a024-bcd74fb9328d", + "id" : "cd756473-4606-4150-9ba5-5b96e6f39c3a", "alias" : "registration", "description" : "registration flow", "providerId" : "basic-flow", @@ -2643,7 +2674,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "8b17eabe-4ffb-448f-88b2-9cf92e4c4bbd", + "id" : "574fcee6-e152-4069-b328-a7fe33aded3a", "alias" : "registration form", "description" : "registration form", "providerId" : "form-flow", @@ -2679,7 +2710,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "1b5ab651-8ccc-40db-bc74-7da9e0fc4909", + "id" : "e5a890ee-140a-4ab3-8d79-87e3499385b0", "alias" : "reset credentials", "description" : "Reset credentials for a user if they forgot their password or something", "providerId" : "basic-flow", @@ -2715,7 +2746,7 @@ "userSetupAllowed" : false } ] }, { - "id" : "1c50ddbb-5e14-43c0-b0ad-a92db16b78c6", + "id" : "6243167c-7e2e-4cc7-b35d-bad7862dc9ef", "alias" : "saml ecp", "description" : "SAML ECP Profile Authentication Flow", "providerId" : "basic-flow", @@ -2731,13 +2762,13 @@ } ] } ], "authenticatorConfig" : [ { - "id" : "99e421d5-9650-46db-8f9c-1363ec50b78e", + "id" : "ae605746-d169-4a81-8348-b5f52e07ae14", "alias" : "create unique user config", "config" : { "require.password.update.after.registration" : "false" } }, { - "id" : "75a7b814-a012-4941-a768-08162597214c", + "id" : "c5feb20c-eea5-4556-b9f8-797be4d67e26", "alias" : "review profile config", "config" : { "update.profile.on.first.login" : "missing" @@ -2817,13 +2848,14 @@ "clientOfflineSessionIdleTimeout" : "0", "actionTokenGeneratedByUserLifespan-reset-credentials" : "", "cibaInterval" : "5", + "realmReusableOtpCode" : "false", "cibaExpiresIn" : "120", "oauth2DeviceCodeLifespan" : "600", "actionTokenGeneratedByUserLifespan-idp-verify-account-via-email" : "", "parRequestUriLifespan" : "60", "clientSessionMaxLifespan" : "0" }, - "keycloakVersion" : "19.0.3", + "keycloakVersion" : "20.0.1", "userManagedAccessAllowed" : false, "clientProfiles" : { "profiles" : [ ] diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/development.yml b/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/development.yml index 9a9cb3fb..636ed6f2 100644 --- a/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/development.yml +++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/development.yml @@ -4,6 +4,7 @@ groups: admin: users: [ + admin, jakub, kb, alex, @@ -16,9 +17,6 @@ groups: elizabeth, jon, natalia, - harmeet, - sasha, - manuchehr, ] Finance Team: @@ -64,12 +62,17 @@ groups: core, fin, fin1, + harmeet, lead, lead1 ] core-contributor: - users: [core] + users: + [ + core, + harmeet, + ] permissions: admin: diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/terraform_deployed_environment.yml b/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/terraform_deployed_environment.yml index 26bdc831..7dd8f2ff 100644 --- a/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/terraform_deployed_environment.yml +++ b/spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/terraform_deployed_environment.yml @@ -4,6 +4,7 @@ groups: admin: users: [ + admin, jakub, kb, alex, @@ -16,9 +17,6 @@ groups: elizabeth, jon, natalia, - harmeet, - sasha, - manuchehr, ] Finance Team: @@ -64,12 +62,17 @@ groups: core, fin, fin1, + harmeet, lead, lead1 ] core-contributor: - users: [core] + users: + [ + core, + harmeet, + ] permissions: admin: diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/models/process_instance.py b/spiffworkflow-backend/src/spiffworkflow_backend/models/process_instance.py index 570e7455..f06eb953 100644 --- a/spiffworkflow-backend/src/spiffworkflow_backend/models/process_instance.py +++ b/spiffworkflow-backend/src/spiffworkflow_backend/models/process_instance.py @@ -112,7 +112,7 @@ class ProcessInstanceModel(SpiffworkflowBaseDBModel): "bpmn_version_control_identifier": self.bpmn_version_control_identifier, "bpmn_version_control_type": self.bpmn_version_control_type, "spiff_step": self.spiff_step, - "username": self.process_initiator.username + "username": self.process_initiator.username, } @property diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py index 0505f755..6f09df97 100644 --- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py +++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py @@ -814,7 +814,9 @@ def process_instance_list( # process_model_identifier = un_modify_modified_process_model_id(modified_process_model_identifier) process_instance_query = ProcessInstanceModel.query # Always join that hot user table for good performance at serialization time. - process_instance_query = process_instance_query.options(joinedload(ProcessInstanceModel.process_initiator)) + process_instance_query = process_instance_query.options( + joinedload(ProcessInstanceModel.process_initiator) + ) if report_filter.process_model_identifier is not None: process_model = get_process_model( diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_report_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_report_service.py index 1f2a7bb6..fc5a93da 100644 --- a/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_report_service.py +++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_report_service.py @@ -125,7 +125,6 @@ class ProcessInstanceReportService: {"Header": "end_in_seconds", "accessor": "end_in_seconds"}, {"Header": "username", "accessor": "username"}, {"Header": "status", "accessor": "status"}, - ], "filter_by": [ { diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_service.py b/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_service.py index 24048afb..f98eaae1 100644 --- a/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_service.py +++ b/spiffworkflow-backend/src/spiffworkflow_backend/services/process_instance_service.py @@ -329,7 +329,7 @@ class ProcessInstanceService: ) -> dict[str, Any]: """NOTE: This is crazy slow. Put the latest task data in the database.""" """Serialize_flat_with_task_data.""" - #results = {} + # results = {} # try: # processor = ProcessInstanceProcessor(process_instance) # process_instance.data = processor.get_current_data()