Skip to Content (Press Enter)
2018-10-29 08-31-03
João Marques
 
MVP
44Views
3Comments
[Microsoft Login Connector - Traditional Web] Sync roles removing other application roles
Question
Roles
Authentication
Forge

Good afternoon,


As we are exploring login with Microsoft Azure, we were taking a closer look to the action SyncRoles to make sure the user has his roles up to date when he logs in.

As we were taking a look, we realized the following:

  • Usually, Azure applications login payload only includes the application roles (e.g. AppA Manager) and does not include roles the same user has on other applications (e.g. AppB Manager);
  • The action will revoke from the user all his current roles in OutSystems database and add the new ones (see code screenshot below);
  • Given the scenario where user is AppA Manager and AppBManager, if we run this sync after user logins via AzureAD in AppA, his AppB Manager role would be revoked. When the user opened another tab for AppB he would not have access.

Do you foresee a new version where this situation gets handled?

For instance, when registering a new application on the Management application, register the roles of that application (like it is done with eSpaces and resources) and adapt the SyncRoles to only revoke the application roles?


Thanks in advance.

Best regards,

João Marques

1
0
01 Sep 2020
Copy Link
2018-11-30 08-20-55
Hendra

Hi,

I'm facing similar issue like you.

Even worse, my response didn't include any "roles". It's empty. Because the Azure role is empty, it always remove all assign Outsystems Roles to current user.

Is there any step i missed for configure the user in Azure? the user is already assing to specific groups in azure

0
0
08 Aug 2022
Copy Link
2020-09-21 08-42-47
Vincent Koning

Hi Hendra,

Have you followed the steps are mentioned in the documentation? I can't test this myself since we don't register the roles inside an application via Azure AD.

Greetings,

Vincent

0
0
15 Aug 2022
Copy Link
2020-09-21 08-42-47
Vincent Koning

Hi João,

Thank you for the bug report. The solution that I'm thinking of be in the form of;

- Add the user to all roles listed in the payload.
- Remove the user from all other application roles.

Would this be sufficient for your use-case?

Greetings,

Vincent

0
0
15 Aug 2022
Copy Link
Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.