You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pages/module-reference/module-admin-adobe-ims.md
+34-8Lines changed: 34 additions & 8 deletions
Original file line number
Diff line number
Diff line change
@@ -4,16 +4,20 @@ description: README.md contents of the module from the source code
4
4
---
5
5
6
6
# Magento_Admin_Adobe_Ims module
7
+
7
8
The Magento_Admin_Adobe_Ims module contains integration with Adobe IMS for backend authentication.
8
9
9
10
For information about module installation in Magento 2, see [Enable or disable modules](https://devdocs.magento.com/guides/v2.4/install-gde/install/cli/install-cli-subcommands-enable.html).
10
11
11
12
# CLI command usage:
13
+
12
14
## bin/magento admin:adobe-ims:enable
15
+
13
16
Enables the AdminAdobeIMS Module. \
14
17
Required values are `Organization ID`, `Client ID`, `Client Secret` and `2FA enabled`
15
18
16
19
### Argument Validation
20
+
17
21
On enabling the AdminAdobeIMS Module, the input arguments will be validated. \
18
22
The pattern for the validation are configured in the di.xml
19
23
@@ -28,20 +32,23 @@ The pattern for the validation are configured in the di.xml
28
32
</type>
29
33
```
30
34
31
-
We check if the arguments are not empty, as they are all required.
35
+
We check if the arguments are not empty, as they are all required.
32
36
33
37
For the Organization ID, Client ID and Client Secret, we check if they contain only alphanumeric characters. \
34
38
Additionally for the Organization ID, we check if it matches 24 characters and optional has the suffix `@AdobeOrg`. But we only store the ID and ignore the suffix.
35
39
Also make sure 2FA is enabled for the Organization in Adobe Admin Console.
36
40
37
41
## bin/magento admin:adobe-ims:disable
42
+
38
43
Disables the AdminAdobeIMS Module.
39
44
When disabling, the `Organization ID`, `Client ID` and `Client Secret` values will be deleted from the config.
40
45
41
46
## bin/magento admin:adobe-ims:status
47
+
42
48
Shows if the AdminAdobeIMS Module is enabled or disabled
43
49
44
50
## bin/magento admin:adobe-ims:info
51
+
45
52
Example of getting data if Admin Adobe Ims module is enabled:\
46
53
Client ID: 1234567890a \
47
54
Organization ID: 1234567890@org \
@@ -50,11 +57,13 @@ Client Secret configured
50
57
If Admin Adobe Ims module is disabled, cli command will show message "Module is disabled"
51
58
52
59
# Admin Login design
60
+
53
61
The admin login design changes when the AdminAdobeIms module is enabled and configured correctly via the CLI command.
54
62
We have added the customer layout handle `adobe_ims_login` to deal with all the design changes.
55
63
This handle is added via `\Magento\AdminAdobeIms\Plugin\AddAdobeImsLayoutHandlePlugin::afterAddDefaultHandle`.
56
64
57
65
The layout file `view/adminhtml/layout/adobe_ims_login.xml` adds:
66
+
58
67
* The bundled [Adobe Spectrum CSS](https://opensource.adobe.com/spectrum-css/).
59
68
* New classes to current Magento html items,
60
69
* Our new "Login with Adobe ID" button template,
@@ -64,6 +73,7 @@ We have included the minified css and the used svgs from Spectrum CSS with our m
64
73
To rebuild the minified css run the command `./node_modules/.bin/postcss -o dist/index.min.css index.css` after npm install from inside the web directory.
65
74
66
75
# AdminAdobeIMS Callback
76
+
67
77
For the AdobeIMS Login we provide a redirect_uri on the request. After a successful Login in AdobeIMS, we get redirected to provided redirect_uri.
68
78
69
79
In the ImsCallback Controller we get the access_token and then the user profile.
@@ -72,22 +82,25 @@ We then check if the assigned organization is valid and if the user does exist i
72
82
If there went something wrong during the authorization, the user gets redirected to the admin login page and an error message is shown.
73
83
74
84
# Organization ID Validation
85
+
75
86
During the authorization we check if the configured `Organization ID` provided on the enabling CLI command is assigned to the user.
76
87
77
88
In the profile response from Adobe IMS must be a `roles` array. There we have all assigned organizations to the user.
78
89
79
90
We compare if the configured organization ID does exist in this array and also the structure of the organization ID is valid.
80
91
81
92
# Admin Backend Login
93
+
82
94
Login with the help Adobe IMS Service is implemented. The redirect to Adobe IMS Service is performed-
83
95
The redirect from Adobe IMS is done to \Magento\AdminAdobeIms\Controller\Adminhtml\OAuth\ImsCallback controller.
84
96
85
97
The access code comes from Adobe, the token response is got on the basis of the access code,
86
-
client id (api key) and client secret (private key).
87
-
The token response access token is used for getting user profile information.
98
+
client id (api key) and client secret (private key).
99
+
The token response access token is used for getting user profile information.
88
100
If this is successful, the admin user will be logged in and the access tokens is added to session as well as token_last_check_time value.
89
101
90
102
# ACCESS_TOKEN saving in session and validation
103
+
91
104
When AdminAdobeIms module is enabled, we check each 10 minutes if ACCESS_TOKEN is still valid.
92
105
For this when admin user login and when session is started, we add 2 extra variables to the session:
93
106
token_last_check_time is current time
@@ -99,12 +112,14 @@ If token is valid, value token_last_check_time will be updated to current time a
99
112
If token is not valid, session will be destroyed.
100
113
101
114
# Admin Backend Logout
115
+
102
116
The logout from Adobe IMS Service is performed when Magento Admin User is logged out.
103
117
It's triggered by the event `controller_action_predispatch_adminhtml_auth_logout`
104
118
105
119
We do external LogOut by call to IMS. Session revoke is standard Magento behavior
106
120
107
121
# Admin Created Email
122
+
108
123
We created an Observer for the `admin_user_save_after` event. \
109
124
There we check if the customer object is newly created or not. \
110
125
When a new admin user got created in Magento, he will then receive an email with further information on how to login.
@@ -115,37 +130,42 @@ They are called `admin_adobe_ims_email_header_template` and `admin_adobe_ims_ema
115
130
The notification mail will be sent inside our `AdminNotificationService` where we can add and modify the template variables.
116
131
117
132
# Error Handling
133
+
118
134
For the AdminAdobeIms Module we have two specific error messages and one general error message which are shown on the Admin Login page when an error occured.
119
135
120
136
### AdobeImsTokenAuthorizationException
137
+
121
138
Will be thrown when there was an error during the authorization. \
122
139
e. g. a call to AdobeIMS fails or there was no matching admin found in the Magento database.
123
140
124
141
### AdobeImsOrganizationAuthorizationException
142
+
125
143
Will be thrown when the admin user who wants to log in does not have the configured organization ID assigned to his AdobeIMS Profile.
126
144
127
145
### Error logging
146
+
128
147
Whenever an exception is thrown during the Adobe IMS Login, we will log the specific exception message but show a general error message on the admin login form.
129
148
130
-
Errors are logged into the `/var/log/admin_adobe_ims.log` file.
149
+
Errors are logged into the `/var/log/admin_adobe_ims.log` file.
131
150
132
151
Logging can be enabled or disabled in the config on changing the value for `adobe_ims\integration\logging_enabled` or in the Magento Admin Configuration under `Advanced > Developer > Debug`. \
133
152
There you can switch the toggle for `Enable Logging for Admin Adobe IMS Module`
134
153
135
154
# Password usage in Admin UI
155
+
136
156
When the AdobeAdminIMS Module is enabled, we do not need any password fields in the Magento admin backend anymore.
137
157
138
158
So we removed the "Password" and "Password Confirmation" fields of the user forms.
139
159
This is done by the plugin `\Magento\AdminAdobeIms\Plugin\RemovePasswordAndUserConfirmationFormFieldsPlugin`.
140
-
Here we remove the password and password confirmation field.
160
+
Here we remove the password and password confirmation field.
141
161
As the verification field is just hidden, we set a random password to bypass the input filters of the Save and Delete user Classes.
142
162
The `\Magento\AdminAdobeIms\Plugin\RemoveUserValidationRulesPlugin` plugin is required to remove the password fields from the form validation.
143
163
We update the "Current User Identity Verification" fieldset to add "Verify Identity with Adobe IMS" button instead "Your Password" field.
144
164
This is done by the plugins: `Magento\AdminAdobeIms\Plugin\Block\Adminhtml\User\Edit\Tab\AddReAuthVerification`, `Magento\AdminAdobeIms\Plugin\Block\Adminhtml\System\Account\Edit\AddReAuthVerification`, `Magento\AdminAdobeIms\Plugin\Block\Adminhtml\User\Role\Tab\AddReAuthVerification` and `Magento\AdminAdobeIms\Plugin\Block\Adminhtml\Integration\Edit\Tab\AddReAuthVerification`.
145
165
146
166
As we update the current user verification field, we have the `\Magento\AdminAdobeIms\Plugin\ReplaceVerifyIdentityWithImsPlugin` plugin to verify the `AdobeReAuthToken` of the current admin user in AdobeIMS and only proceed when it is valid.
147
167
148
-
For the newly created user will be a random password generated, as we did not modify the admin_user table, where the password field can not be null.
168
+
For the newly created user will be a random password generated, as we did not modify the admin_user table, where the password field can not be null.
149
169
This is done in the `\Magento\AdminAdobeIms\Plugin\UserSavePlugin`.
150
170
151
171
We also disabled the "Change password in 30 days" functionally, as we don't need the Magento admin user password for the login.
@@ -155,12 +175,13 @@ When the AdminAdobeIMS Module is disabled, the user can not be log in when using
155
175
Instead, the forgot password function must be used to reset the password.
156
176
157
177
# WEB API authentication using IMS ACCESS_TOKEN
178
+
158
179
When Admin Adobe IMS is enabled, Adobe Commerce admin users will stop having credentials (username and password).
159
180
These admin user credentials are needed for getting token that can be used to make requests to admin web APIs.
160
181
It means that will be not possible to create token because admin doesn't have credentials. In these case we have to use IMS access token.
161
182
162
183
`\Magento\AdminAdobeIms\Model\Authorization\AdobeImsTokenUserContext` new implementation for `\Magento\Authorization\Model\UserContextInterface` was created.
163
-
In the implementation IMS access token is validated and read to get created_at and expires_in data.
184
+
In the implementation IMS access token is validated and read to get created_at and expires_in data.
164
185
If access_token_hash already exists in admin_adobe_ims_webapi table, then we can get admin_user_id.
165
186
If access_token_hash does not exist in admin_adobe_ims_webapi table, then we have to make request to IMS service to get Adobe user profile, that contain email.
166
187
Using email from Adobe user profile we can check if admin user with these email exists in Magento. If so, we save relevant data into admin_adobe_ims_webapi table.
@@ -178,10 +199,12 @@ Both of values are checked in function isTokenExpired \Magento\AdminAdobeIms\Mod
178
199
it means that with default values is not possible to use tokens that older than 4h.
179
200
180
201
### IMS access token verification.
181
-
To verify token a public key is required. For more info https://wiki.corp.adobe.com/display/ims/IMS+public+key+retrieval
202
+
203
+
To verify token a public key is required. For more info https://wiki.corp.adobe.com/display/ims/IMS+public+key+retrieval
182
204
In Admin Adobe Ims module was defined path where certificate has to be downloaded from.
183
205
By default, in config.xml, these value for production.
184
206
For testing reasons, developers can override this value, for example in env.php file like this:
207
+
185
208
```
186
209
'system' => [
187
210
'default' => [
@@ -193,6 +216,7 @@ For testing reasons, developers can override this value, for example in env.php
193
216
]
194
217
]
195
218
```
219
+
196
220
Certificate value is cached.
197
221
198
222
This authentication mechanism enabled for REST and SOAP web API areas.
Copy file name to clipboardExpand all lines: src/pages/module-reference/module-admin-analytics.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -3,4 +3,4 @@ title: AdminAnalytics
3
3
description: README.md contents of the module from the source code
4
4
---
5
5
6
-
The Magento\AdminAnalytics module gathers information about the features Magento administrators use. This information will be used to help improve the user experience on the Magento Admin.
6
+
The Magento\AdminAnalytics module gathers information about the features Magento administrators use. This information will be used to help improve the user experience on the Magento Admin.
After adding this package to Magento, the following changes should be made in the admin panel (navigate to Stores > Settings > Configuration > Adobe Services > Adobe I/O Events > Commerce events):
33
+
32
34
- Set `Enabled` to `Yes`
33
35
- Enter a `Merchant ID`
34
36
- Enter a `Environment ID`
35
37
36
38
## CLI commands defined by module
37
39
38
40
This module defines the following CLI commands:
41
+
39
42
- events:subscribe
40
43
- events:unsubscribe
41
44
- events:list
42
45
- events:list:all
43
46
- events:info
44
47
- events:metadata:populate
45
48
46
-
Please see [documentation](https://developer.adobe.com/commerce/events/get-started/commands/) for details on using these commands.
49
+
Please see [documentation](https://developer.adobe.com/commerce/events/get-started/commands/) for details on using these commands.
0 commit comments