[SOLR-13364] Make Admin UI aware of logged-in users permissions

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Done
• Component/s: Admin UI, Authentication, Authorization, security
• Assignee: Unassigned
• Reporter: Jan Høydahl
• Created: 03/Apr/19 08:29
• Updated: 05/Nov/21 09:29
• Resolved: 05/Nov/21 09:29

Description

We should aim to add fine-grained permission checks to the UI. One way to do this is to add a new REST-endpoint /admin/login/whoami that is always open for all, and that responds with a JSON with current user's permissions. If no user is logged in it will respond with empty list and "No user logged in". Else it will respond with e.g.

{ 
  "user": "john", 
  "roles": ["superuser", "searcher"], 
  "permissions": [
    {"name": "security-edit"},
    {"name": "read"},
    {"name": "customFoo", "path": "/custom/path", "params": {"key": ["val1", "val2"]} }
  ]
}

The Admin UI can then request this endpoint and cache the info, so that it may make decisions to hide/grey out certain menu options throughout the UI. E.g. the create collection button would be disabled if the user lacks the predefined permission "collection-admin-edit".

In theory the UI must also check if the user has a custom permission with path /admin/collections and params action=CREATE, but it is not likely that anyone would create a custom permission for something that is predefined.

Issue Links

• relates to: SOLR-13344 Admin UI inaccessible with RuleBasedAuthorizationPlugin