You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This loopback component enables you to add multi-tenant style access controls to a loopback application. It enables you to restrict access to model data based on a users roles within a specific context.
5
+
This loopback component enables you to add multi-tenant style access controls to a loopback application. It enables you to restrict access to model data based on a user's roles within a specific context.
6
+
7
+
There are two types of access restrictions implemented in this component:
8
+
9
+
**1) Role Resolvers**
10
+
11
+
For each *Group Role* that you define, a dynamic [Role Resolver](https://docs.strongloop.com/display/public/LB/Defining+and+using+roles#Definingandusingroles-Dynamicroles) is attached to the application. These Role Resolvers are responsible for determining wether or not a user has the relevant roles required to access data that belongs to a group context.
12
+
13
+
14
+
**2) Query Filters**
15
+
16
+
An 'access' [Operation Hook](https://docs.strongloop.com/display/public/LB/Operation+hooks) is injected into each Group Content model. This is used to filter search results to ensure that only items that a user has access to (based on their Group Roles) are returned.
2. Create a component-config.json file in your server folder (if you don't already have one)
14
25
@@ -24,7 +35,7 @@ This loopback component enables you to add multi-tenant style access controls to
24
35
25
36
4. Create a middleware.json file in your server folder (if you don't already have one).
26
37
27
-
5. Enable the `loopback#context`, `loopback#token` and `user-context` middleware.
38
+
5. Enable the `loopback#context`, `loopback#token` and `loopback-component-group-access#user-context` middleware.
28
39
29
40
```json
30
41
{
@@ -38,30 +49,54 @@ This loopback component enables you to add multi-tenant style access controls to
38
49
39
50
### Usage
40
51
41
-
In order to use this component you will need to create group access model that can be used to link users to groups and assign group roles. A user can have have multiple roles within the context of a group and each role can define different access grants to REST resources. The *Group Access Model* must have the following three properties:
52
+
**Group Model**
53
+
54
+
You will need to designate one of your models as the *Group Model*. This model will act as parent or container for related group specific data.
55
+
56
+
All models that have a belongsTo relationship to your *Group Model* will be considered as Group Content. Access grants for Group Content are determined by a user's roles within the context of its group as defined in the *Group Access Model*.
42
57
43
-
- userId
44
-
- groupId (configurable foreign key)
45
-
- role
58
+
**Group Roles**
46
59
47
-
Additionally you will need to designate one of your models the *Group Model*. This model will act as parent or container for related group content.
60
+
*Group Roles* can be used in ACL definitions to grant or restrict access to api endpoints to specific group roles.
48
61
49
-
Any other models that have a belongsTo relationship to your Group Model will be considered as Group Content. Access grants for Group Content is determined by the user's roles within the context of the group as defined in the Group Access Model.
62
+
```
63
+
{
64
+
"accessType": "READ",
65
+
"principalType": "ROLE",
66
+
"principalId": "$group:member",
67
+
"permission": "ALLOW"
68
+
}
69
+
```
50
70
51
-
For example:
71
+
The above configuration would grant READ access to all users that have the 'member' role within the context of the group that a model instance belongs to.
52
72
53
-
-**Group Model:** Store (id, name, desxription)
73
+
*Group Roles* can be defined in the component configuration using the `groupRoles` key. *Group Role* names must be prefixed with `$group:` (eg `$group:admin`).
74
+
75
+
**Group Access Model**
76
+
77
+
In order to use this component you will need to create *Group Access Model* that can be used to assign roles to users of a Group. A user can have have multiple roles within the context of a group and each role can be associated with different access grants to REST resources. The default schema for the *Group Access Model* is as follows, although this can be overridden through the component configuration options.
0 commit comments