Uploaded image for project: 'Camunda Optimize'
  1. Camunda Optimize
  2. OPT-7412

Disable/enable user search related features depending on whether user search is available in identity

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Fixed
    • Icon: L3 - Default L3 - Default
    • 3.12.0
    • None
    • backend
    • Not defined

      Context:
      Identity's "bring your own OIDC" topic disables the user search in identity if a user uses their own OIDC with identity. Identity will implement a flag to determine whether or not the user search functionality is available. If the user search is not available, Optimize needs to hide the respective UI. 

      Identity issue: https://github.com/camunda-cloud/identity/issues/2304

      The corresponding Optimize UIConfiguration flag `userSearchAvailable` should mirror the value of `identity.users().available()`. In the FE, the use of this flag will already be implemented with OPT-7404.

      If user search is not available, BE should also skip all user search related checks in the CCSMIdentityservice - basically mimicking the behaviour before identity user management was implemented.

      Note that in a future iteration of this identity feature, user search should be available again and the logic implemented in this ticket can be removed then.

      Note:
      as per discussion with PM, we will not add any extra measures to prohibit users who were added to collections prior to reconfiguring identity with a custom OIDC from accessing those collections, or logic adjusting previously created alerts or digests. These limitations are accepted because these scenarios are expected to be edge cases, users with custom OIDC are expected to start with a clean install.
      So, the following scenarios/limitations will occur:

      Limitation 1: User collection management

      • Optimize is used with identity with keycloak, user search functionality is available
      • User is added to a collection
      • Identity is updated and configured with custom OIDC, making user search unavailable
      • Optimize hides users tab in collections
      • User previously added to collection will still be able to access collection. User cannot be removed from the collection via UI

      Limitation 2: Alerts

      • Optimize is used with identity with keycloak, user search functionality is available
      • Alert is added to collection
      • Identity is updated and configured with custom OIDC, making user search unavailable
      • Optimize hides alerts tab in collections
      • Alert previously created still exists and will be sent out if email service is configured. It is not possible to disable alert in UI

      Limitation 3: Digests

      • Optimize is used with identity with keycloak, user search functionality is available
      • Digest is enabled for a process
      • Identity is updated and configured with custom OIDC, making user search unavailable
      • Optimize hides digest feature in UI
      • Digest  previously created still exists and will be sent out if email service is configured. It is not possible to disable digest in UI

      AT:

      • userSearchAvailable UIConfiguration flag is set to the value of `identity.users().available()`
      • if user search not available, collection access is limited to owner
      • oder user search related functionality is skipped in BE

      Hint:
      Basically, if user search is not available just revert behaviour of CCSMIdentityService to before OPT-7403 was implemented.

      Testing Notes:

      If user search is not available in identity due to usage of https://github.com/camunda/product-hub/issues/739 , Optimize UI hides user search functionality (collections user tab, alerts, digests). See this comment on how to configure identity so that user search is not available: https://github.com/camunda-cloud/identity/issues/2304#issuecomment-1831589861 
      No error messages or issues using optimize especially accessing collections.

       

       

        This is the controller panel for Smart Panels app

              Unassigned Unassigned
              helene.waechtler Helene Waechtler
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: