Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Admin authentication problems #427

Open
fzaninotto opened this issue Jul 12, 2024 · 3 comments · May be fixed by #429
Open

Admin authentication problems #427

fzaninotto opened this issue Jul 12, 2024 · 3 comments · May be fixed by #429

Comments

@fzaninotto
Copy link
Contributor

Description

When visiting the demo for the first time, if I click on the "Admin" button, I see a login page. It presents 2 possible test accounts: John Doe and Chuck Norris.

image

Logging in with the first one leads to an admin with an error message.

image

Furthermore, it is impossible to log out to try the other user. Clicking on the "Logout" button in the user menu doesn't redirect to the login page.

How to reproduce

  1. Go to https://demo.api-platform.com
  2. Click on the "Admin" button

Possible Solution

  • Do not propose the user John Doe in this screen
  • Fix the logout
@vincentchalamon
Copy link
Contributor

I think it's more complex than it appears...

The whole project uses Keycloak for authentication and authorization, so it shares the same login page. AFAIK it's not easily possible to have a different login page between the admin and the front without changing the architecture of the project with a definitively more complex one... (this project aims to be simple)

The logout bug has a fix in progress (#428).

IMHO the problem here is that this admin doesn't show a clean "Forbidden" page here. Do you know how to handle that properly?

@fzaninotto
Copy link
Contributor Author

React-admin has the notion of "authentication" (anonymous vs identified users) and of "authorization" (the levels of credentials an authenticated user has). Displaying a custom "forbidden" page to an identified users without enough permissions requires reading the permissions with usePermissions and rendering an unauthorized page if there is not enough permissions:

https://marmelab.com/react-admin/usePermissions.html

You'll need to implement the authProvider.getPermissions based on the Keycloak response.

@vincentchalamon
Copy link
Contributor

I tried to implement something, but I'm definitely not a JS expert... I'm stuck on the following error, if you have any idea how to fix it:
image

Reproducer available here: #429

@vincentchalamon vincentchalamon linked a pull request Jul 15, 2024 that will close this issue
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: implement admin permissions api-platform/demo
2 participants
@fzaninotto @vincentchalamon