Notes on simple Demo

Endpoints

• GET POST PUT DELETE /company
• GET POST PUT DELETE /item

Roles

• Admin
• User

Policies

• User can only GET
• Admin can do All

User Claims

User the "User Permission" (i.e. role in LDAP) to store either admin or user.

Front end application

Angular 8 application using AppAuth-JS as client library

Access Management Strategy

The Angular application will use the access token obtained in the OpenID Connect flow when calling the API. In the Gluu Server Token Introspection Script,replace the scope claim with either 'admin' on 'user'.

In the script, you can get the user role as follows:

context.getGrantOfIntrospectionToken().getUser()
role = userService.getCustomAttribute(user, "role")

or

userService = CdiUtil.bean(UserService)
user = context.getGrantOfIntrospectionToken().getUser();
role = userService.getCustomAttribute(user, "role")

Once the scope is properly set, we should be able to filter the API's based on method and scope.