[CAUSEWAY-3618] Secman should copy the user's roles into the UserMemento (as obtained via UserService).

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.0-RC2
• Fix Version/s: 2.0.0-RC3
• Component/s: Ext Sec Secman
• Assignee: Daniel Keir Haywood
• Reporter: Daniel Keir Haywood
• Created: 29/Sep/23 08:19
• Updated: 02/Oct/23 20:32
• Resolved: 29/Sep/23 09:08

Description

The `UserService#getUser()` returns a `UserMemento`, which is a representation of the current user's roles and context (locale, time, timezone etc).  This is independent of security mechanism configured.

The `UserMemento.AUTHORIZED_USER_ROLE` (String constant) is used by the Wicket viewer as a required role for protected pages ; it's the responsibility of the security mechanism to add this role during login.  If Spring is used for authentication, then this is done within `SpringSecurityFilter`.  Thus, when querying `UserService#getUser()` with Spring, the only role we see on `UserMemento` is this one.

The UserMementoRefiner SPI allows security mechanisms to fine-tune this `UserMemento`.  Secman already has an implementation of this (`UserMementoRefinerFromApplicationUser`), which adjusts the timezone etc, but it currently does not yet copy over the secman-defined roles.  It should do this as well.

Issue Links

• links to: GitHub Pull Request #1918