JASPER-551: Implement a mapping field in JASPER that can be used to derive the PCSS user details (PART 2)

[ronaldo-macapobre]

Pull Request for JIRA Ticket: JASPER-551

Issue ticket number and link

https://jira.justice.gov.bc.ca/browse/JASPER-551

Description

• Add UserGuid, NativeGuid and JudgeId to User and UserDto objects. UserGuid is populated automatically with idir_user_guid from Keycloak while NativeGuid and JudgeId will be populated manually which will help JASPER locate the PCSS User info of the currently logged on user.
• Create OnPostAuthSuccess function to determine the appropriate judgeId and homeLocationId to load depending on the authenticated user.

Type of change-

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

• Local

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[WadeBarnes]

Some of what's contained in this code is related to what Devin is doing here; #457. So there might be some co-ordination required.

It's fine to populate the user account in JASPER with some basic information regarding a user authenticated by KeyCloak, but we still need to verify and validate (authorize) their access to JASPER before providing any access.

Short term:

• If the user is not assigned to one of the known, expected, KeyCloak groups - then access denied.

Long term:

• Existing account - access granted based on their account status (enabled/disabled), and assigned roles and permissions.
• First time login - Populate basic account info (only if they request access or have a PCSS account), then verify and validate the request
  • Check with PCSS (if/when possible) - User has a valid account, configure their JASPER account accordingly and grant them equivalent access to JASPER.
  • No existing PCSS account - Provide the user with the option to request access.
    • Regardless of whether the user requests access - Notify an admin there was a failed login attempt.
    • User requests access - Notify an admin of the request and provide link the pre-populated account info for review and approval.

[devinleighsmith]

Hey Wade, Ronnie and I talked about this, and we think this is logic is consistent with the goals you've listed above. Primarily, this is because Ronnie is only creating a skeleton user during login here - the logic surrounding the judge assignment as well as roles and permissions will not execute unless there is corresponding data in PCSS/Mongo.

However, Ronnie will need to update this to set the skeleton user to disabled.

So when a user logs in for the first time, this logic will run, the skeleton user gets created (which allows an admin to track failed authorization attempts). Next the frontend will redirect the user to the access request page, where they have the option of requesting access. This will allow the user to set a flag indicating their request for admin review.

Of course, the missing part here is the PCSS role synchronization, but that will come in its own PR.

[devinleighsmith]

as discussed, this should be false.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[devinleighsmith]

@ronaldo-macapobre Looking through this again and I'm not sure this is safe, as this will create a new user if the user's email changes. I think in most cases email is stable but may not always be - I know in the case of sso standard they recommend that the preferred_username guid is used instead.

[ronaldo-macapobre]

I see, thanks for catching that. I only used the email for duplicate checking as a quick safeguard, but we can definitely update it. I’ll switch the code to use preferred_username when I pick up a future story that involves this.