Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Better handle of context access restriction #9251

Closed
2 tasks done
dsuren1 opened this issue Jun 26, 2023 · 2 comments · Fixed by #9298
Closed
2 tasks done

Better handle of context access restriction #9251

dsuren1 opened this issue Jun 26, 2023 · 2 comments · Fixed by #9298

Comments

@dsuren1
Copy link
Contributor

dsuren1 commented Jun 26, 2023

Description

The context access requires modification when user faces one the below scenario

  1. A user want to load a Context but not logged in
    Current behavior: "Resource not found"
    Expected behavior: Redirect to login form if the user is anonymous and try access protected context

  2. A user want to load a Context but doesn't have permission to access it
    Current behavior: "Error loading context"
    Expected behavior: "User is not allowed to access this context"

  3. Make Back to Home page redirect configurable in FeedbackMask component. Use miscSettings -> homePath

  4. Also provide an option to configure login page when provided. i.e When in Mapstore, the login panel is shown upon requesting a resource when the user is not logged in, else redirect to the loginpage (ex: for geOrchestra /?login this has to be handled in the respective project)

Suggested tasks:

  • Modify context to prompt user with a login form when it needs user login just like with map, geostory & dashboard (i.e when not logged in and accessing protected content)
  • Modify project with a handler, maybe a custom handler which can be registered and triggered in these use cases which has custom authentication feature. Or simply add a epic to listen to certain login required actions and in turn navigate user to a custom login page or dispatch custom login action. That's the case of MS resources defined in geOrchestra, for example:

image

@offtherailz Kindly let me know your thoughts.

Other useful information

georchestra/mapstore2-georchestra#415

@offtherailz
Copy link
Member

offtherailz commented Jun 26, 2023

@dsuren1 here my thoughts

Expected behaviors and responses

Expected behavior: Redirect to login form if the user is anonymous and try access protected context

MapStore can not recognize if the resource do not exist at all or if it is only protected. So we should be explicit on it.

The cases for a 404 response is:

  • The map do not exist
  • You are not logged in
  • You are logged in but your user can not see the resource

Moreover you may have problems accessing the context, the map, or both.

For this reason we can simply tell the user:

If you are not logged in;

  • Resource not found > redirect to the login is ok. MapStore for maps shows directly the login prompt

If you are logged in: a message like this, (maybe explaining that the map and/or context have problem) can be ok.

https://dev-mapstore.geosolutionsgroup.com/mapstore/#/viewer/3453667787

Note:

  • The back to home link in this case is ambigous, we have a different home path in the geOrchstra environment, so the button should be obmitted or configurable.

Suggested tasks.

something is already in the project, to properly redirect to login. It needs to be simply reused/modified for contexts (and optionally map in contexts). Note: Check point 4 of the acceptance criteria for this

@tdipisa
Copy link
Member

tdipisa commented Jun 27, 2023

The back to home link in this case is ambigous, we have a different home path in the geOrchstra environment, so the button should be obmitted or configurable.

The home page may not be present in geOrchestra if it has been configured to not provide that. Therefore we should simply tell the user to authenticate with a message on the screen or directly redirect to the login form. That's only for the geOrchestra case, of course, or other downstream projects where the home page is not used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment