OAUTH role and rights mapping

A mapping between the oauth user and the internal roles used by the solution hub service is required. The basic idea is that the membership defined by oauth roles is used as indicator for the Solution hub rights.

The group mapping is configured in a xml-file that can be found in the "config/security_settings.xml" of the Solution hub installation directory.

The basic configuration is defined in the section "oauthGroups". An example can be seen in the following code fragment:

<!--
 | #################################################################################################################
 | # oauthGroups
 | #################################################################################################################
 |
 | Contains a list of groups that are mapped between oauth roles and internal Solution hub groups. This mapping
 | allows the flexible configuration between oauth and solution hub. For every group a set of roles has to be given
 | that define the roles that are associated with this group
 -->
<authTypeMapping type="oauth" >

    <!--
     | #################################################################################################################
     | # Definition of a mapping between oauth group and Solution hub rights
     | #################################################################################################################
     |
     | name: the name of the oauth group
     | description: a human-readable text that describes the idea of this group
     | hasRoles: contains a comma separated list of all roles that are assigned to this oauth group
     |           If * is given, all configured roles are assigned
     | isMemberOf: contains a comma separated list of all base groups that are assigned to this oauth group
     |           If * is given, all configured roles are assigned
     -->

    <group name="Admin" description="A full administration user for Solution hub" >
        <hasRoles>*</hasRoles>
        <isMemberOf></isMemberOf>
    </group>

    <group name="ReadOnly" description="A user that is intended for monitoring only" >
        <hasRoles></hasRoles>
        <isMemberOf>ReadAccess</isMemberOf>
    </group>

</authTypeMapping>

Additionally, the definition of the base groups can be changed in the configuration file. An example can be seen in the following code fragment:

<!--
 | #################################################################################################################
 | # baseGroups
 | #################################################################################################################
 |
 | Definition of different groups that subsume always a set of rules
 |
 -->
<baseGroups>

    <!--
     | #################################################################################################################
     | # Definition of one Solution hub group
     | #################################################################################################################
     |
     | name: the name of solution hub group
     | description: a human-readable text that describes the idea of this group
     | hasRoles: contains a comma separated list of all roles that are assigned to this oauth group
     | isMemberOf: contains a comma separated list of all base groups that are assigned to this oauth group
     -->

    <group name="DistributedManagement.Admin">
        <isMemberOf>ReadAccess,WriteAccess</isMemberOf>
        <hasRoles></hasRoles>
    </group>

    <group name="ReadAccess" >
        <hasRoles>
            Deployment.Read,Artifact.Read,SystemEvents.View,BusinessEvent.Read        
        </hasRoles>
    </group>

    <group name="WriteAccess" >
        <hasRoles>
            SystemEvents.Delete,BusinessEvent.Modify,BusinessEvent.Delete,Artifact.Modify,Artifact.Delete,Deployment.Modify,Deployment.Delete,Deployment.Sync    
        </hasRoles>
    </group>

    <group name="Licensing" >
        <hasRoles>
            Licensing.View,Licensing.Admin
        </hasRoles>
    </group>
                    
</baseGroups>

info

If this file is reloaded automatically if it is changed manually