mattcasters opened a new pull request, #7819: URL: https://github.com/apache/hop/pull/7819
## Summary Draft implementation for [issue #3105](https://github.com/apache/hop/issues/3105): authentication and role-based authorization for Hop Web, with UI gating, configuration UI, project access control, and documentation. ### Authentication modes | Mode | Description | |------|-------------| | **NONE** | Open access (default; unrestricted session, desktop-like) | | **EXTERNAL** | Trust servlet container / reverse proxy principal; map container or LDAP groups to Hop roles | | **BASIC** | Hop-managed form login (`/login`) against `users.json` (PBKDF2); optional HTTP Basic for API clients | | **OAUTH2** | OpenID Connect authorization code + PKCE (Nimbus); claim groups map to Hop roles | Config lives under `HOP_CONFIG_FOLDER/security/` (`security-config.json`, `users.json`). Env vars bootstrap mode, admin seed, demo users, and OAuth secrets (`HOP_WEB_SECURITY_MODE`, `HOP_WEB_SEED_DEMO_USERS`, `HOP_WEB_OAUTH_*`, …). Local helpers: `docker/run-hop-web-local-with-basic.sh`, `-with-oauth.sh`, `-with-users.sh`, and `docker/local-auth-config/`. ### Roles and permissions Built-in roles **Admin**, **User**, **Operator**, **Read-only** with fine-grained `Permission` values (`file.edit`, `file.save`, `run.execute`, `metadata.write`, `security.manage`, …). - Session context: `HopSecurity` / `HopSecurityContext` (+ source/LDAP group names for project rules) - Menus, toolbars, context actions, and keyboard shortcuts gated via capability + permission mappers - Mutations re-check permission and show *Access denied* when blocked ### UI authorization (read-only and canvas) - **`IDialogEditable`** on transform/action/metadata bases → `BaseDialog.defaultShellHandling` opens dialogs read-only without `file.edit` / `metadata.write` - Legacy dialogs covered via dialog-subject stack on open call sites - Metadata perspective editors go read-only; dirty flag suppressed without write permission - Graph: no drag/move/resize/delete/hop create without `file.edit` (pipeline + workflow) - RAP-safe handling (no hard `StyledText` class load on Hop Web) ### Security configuration UI Configuration → **Security** (requires `security.manage`): - **General** — mode, welcome message - **OAuth** — issuer, client, redirect, scopes, claims, PKCE - **External** — container/IdP/LDAP → Hop role mappings - **Basic** — users table - **Projects** (Projects plugin) — user / role / group → project access Plugin extension: `@GuiTab(parentId = ConfigSecurityTab.SECURITY_CONFIG_TABS)` + `ISecurityConfigSection`. ### Session UX - Styled login page (logo, welcome text) - Toolbar: signed-in **username** + **Log off** (Hop Web) - Log off clears session (BASIC/OAuth/container as applicable) ### Project access control `projects-access.json`: enable rules by username, Hop role, or LDAP/IdP group. Enforced on project switch, select-project dialog, and startup project load. Admins always allowed; desktop/unrestricted not filtered. ### Documentation `hop-web.adoc` updated with modes, roles, configuration tabs, scripts, and screenshots (`hop-web-login.png`, `hop-web-security-configuration-ui.png`, `hop-web-toolbar-user-and-log-off.png`). ## Test plan - [ ] `NONE` — unrestricted UI (desktop and web) - [ ] `./docker/run-hop-web-local-with-basic.sh` — login as seeded users; roles gate save/edit/run - [ ] Read-only user: dialogs and metadata editors read-only; cannot move/delete transforms/notes; Del blocked - [ ] Operator: execute allowed; save/edit blocked - [ ] Log off returns to login; re-login works - [ ] Configuration → Security tabs load/save; BASIC users persist; External mappings apply - [ ] Projects tab: enable access control; restrict viewer to one project; switcher/startup respect rules - [ ] OAuth path (if IdP available): `./docker/run-hop-web-local-with-oauth.sh` - [ ] Unit tests: security + projects access (`HopSecurityContextTest`, `HopDialogEditGuardTest`, `ProjectsAccessControlTest`, …) ## Notes for reviewers - Large surface area by design (AuthN + AuthZ + UI choke points + docs). Happy to split follow-ups if preferred. - Server-side enforcement of remaining mutation APIs may still need hardening beyond UI gates. - Draft PR for early feedback before polish/CI green. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
