12 Commits (master)

Author	SHA1	Message	Date
Oleksandr Duts	03271187c7	TT#157400 API/UI admins fix authorization for "system" role ... * Users with "system" role can change all items accross the system including the password changing for other users. * Login "system" has persistant "system" role. * "system" login name is restricted for the user input. Change-Id: Ibaecba35a86f71fa8895ce9d9feab8e768b65d14	3 years ago
Kirill Solomko	20e77c7b54	TT#129162 tighten user access checks ... * add additional centralised checks for inactive and read_only users. * use_userdata_from_session=0 now for all auth realms to cause the data re-fetched from the database, to avoid scenarios when a user is set as inactive or read_only and UI keeps using the cached data. the change only affects cookie and JWT subscriber based sessions as in all other cases, the auth data is fetched from the storage regardless. * add is_active=1 flag for the internal 'system' role, as otherwise access would be permanently denied for it. * default 403 error for denied api requests is changed to "Forbidden" instead of "Forbidden path". Change-Id: I1d6d3c765ca8e017e11845c1f5260243a3963c3b	4 years ago
Flaviu Mates	cf619e1136	TT#88203 - Give 'admin' role to admins with is_system flag ... Change-Id: I4c696fac56dec58beb620ed3b5ab9f01e4de75fd	5 years ago
Kirill Solomko	aa279e025a	TT#76111 add admin flags for 'system' user ... * 'system' user must have admin flags properly set Change-Id: I7b38aa590ec4e049186f87d17334a61bb865d233	5 years ago
Kirill Solomko	7862a87639	TT#76111 add lintercept role ... * new c.users.role 'lintercept', that set to when an admin user has enabled 'lawful_intercept' flag * only Administrator page /api/admins and /api/interceptions are available for the role * 'lintercept' role can only see own user and only change password and email Change-Id: Iadcb022a124afbd77b224e734026f380af0170e8	5 years ago
Kirill Solomko	cf51166170	TT#80550 enable admin jwt token for the whole UI ... * add admin_jwt realm * admin JWT tokens are now used to access all non /api content Change-Id: I711d6419f0b624b02b53876a8c9171ab638b5d09 (cherry picked from commit dc4d9ec84b5b1199f17631e9e1f9a39ab1996807)	5 years ago
Kirill Solomko	2c8a11029a	TT#80305 add JWT authentication for admin users ... * /admin_login_jwt now returns a JWT token for admin users and also the JWT token is supported in the authorization process for the admin requests Change-Id: I987640d46bd8a339a959a6b2efb65b6dce06bf8c	5 years ago
Kirill Solomko	ce664263b2	TT#65101 add ccareadmin ccare roles ... * ccareadmin and ccare roles have full access to Customers, Subscribers and their preferences/settings, and read-only access to BillingProfiles,InvoceTemplates, EmailTemplates * ccare role is restricted to the related reseller Change-Id: I6cf7d3adf912f0fa98d1ef5c02abea2f4331ec4b	6 years ago
Rene Krenn	76b88062a1	TT#56411 honor use_session => 0 for bcrypt auth ... Revert "Revert "TT#56411 honor use_session => 0 for bcrypt auth WIP"" This reverts commit 1cfc524f80. Change-Id: I7eb0842bd61a4aaddbe50206fb974110ead8efb6	6 years ago
Rene Krenn	1cfc524f80	Revert "TT#56411 honor use_session => 0 for bcrypt auth WIP" ... This reverts commit 4789f6b61f. Change-Id: I6b514443afe9e2a8dbc1ae4a527a38fd3fc1d1c6	6 years ago
Rene Krenn	4789f6b61f	TT#56411 honor use_session => 0 for bcrypt auth WIP ... Change-Id: I549c4e6fc18b7cb738e99b3a6e254a47db3af0cf	6 years ago
Gerhard Jungwirth	ba3548d825	TT#16003 implement JWT auth ... - read key from specific config file - key is hex encoded + fix: add libcryptx-perl as dependency (actually dep of libcrypt-jwt-perl) + fix: typo in perl (comma instead of assignment) + fix: chomp any preceeding newlines from jwt_secret Change-Id: I6c6bd4dc0d7fa7fa43868afb13b4d8d838d90564	8 years ago