PAM WebSSO Entitlements Details

[HarryKodden]

At this moment the PAM WebSSO successful authentication gives following details:

 {
    "groups": [
        {
            "name": "SURF Research Cloud Live CO",
            "short_name": "live"
        }
    ],
    "info": "User [email protected] has authenticated successfully",
    "result": "SUCCESS",
    "username": "..."
}

We are planning to make use of 1 generic SRAM Service that will be connected to all ResearchCloud VM's that facilitate PAM WebSSO logins. That would allow users to access All these VM's if they are member of just 1 CO for which ResearchCloud has created a VM.
The alternative would be to create sidecar services for each individual CO.

I would suggest to keep it simple and have just 1 generic WebSSO Service that is connected to all CO's.
Then we need to apply additional checks that the authenticated user is indeed member of the CO for which the VM is created.

Therefor we can make use of the group membership delivered in the JSON response.
In order to make a non ambiguous ACL it is proposed to add the SRAM persistent ID to the group membership details, like this:

 {
    "groups": [
        {
            "name": "SURF Research Cloud Live CO",
            "short_name": "live",
            "id": "bccd3caa-b421-4f7a-aeb8-cb12704beb71",
        }
    ],
    "info": "User [email protected] has authenticated successfully",
    "result": "SUCCESS",
    "username": "..."
}

The ACL in the VM then could list the (list of) ID's that a authenticated user must be member of, to allow access

[oharsta]

Wrongfully closed issue

[mrvanes]

OK