-
Task
-
Resolution: Fixed
-
L3 - Default
-
None
-
Not defined
Context:
Identity's "bring your own OIDC" topic disables the user search in identity if a user uses their own OIDC with identity. Identity will implement a flag to determine whether or not the user search functionality is available. If the user search is not available, Optimize needs to hide the respective UI.
Identity issue: https://github.com/camunda-cloud/identity/issues/2304
The corresponding Optimize UIConfiguration flag `userSearchAvailable` should mirror the value of `identity.users().available()`. In the FE, the use of this flag will already be implemented with OPT-7404.
If user search is not available, BE should also skip all user search related checks in the CCSMIdentityservice - basically mimicking the behaviour before identity user management was implemented.
Note that in a future iteration of this identity feature, user search should be available again and the logic implemented in this ticket can be removed then.
Note:
as per discussion with PM, we will not add any extra measures to prohibit users who were added to collections prior to reconfiguring identity with a custom OIDC from accessing those collections, or logic adjusting previously created alerts or digests. These limitations are accepted because these scenarios are expected to be edge cases, users with custom OIDC are expected to start with a clean install.
So, the following scenarios/limitations will occur:
Limitation 1: User collection management
- Optimize is used with identity with keycloak, user search functionality is available
- User is added to a collection
- Identity is updated and configured with custom OIDC, making user search unavailable
- Optimize hides users tab in collections
- User previously added to collection will still be able to access collection. User cannot be removed from the collection via UI
Limitation 2: Alerts
- Optimize is used with identity with keycloak, user search functionality is available
- Alert is added to collection
- Identity is updated and configured with custom OIDC, making user search unavailable
- Optimize hides alerts tab in collections
- Alert previously created still exists and will be sent out if email service is configured. It is not possible to disable alert in UI
Limitation 3: Digests
- Optimize is used with identity with keycloak, user search functionality is available
- Digest is enabled for a process
- Identity is updated and configured with custom OIDC, making user search unavailable
- Optimize hides digest feature in UI
- Digest previously created still exists and will be sent out if email service is configured. It is not possible to disable digest in UI
AT:
- userSearchAvailable UIConfiguration flag is set to the value of `identity.users().available()`
- if user search not available, collection access is limited to owner
- oder user search related functionality is skipped in BE
Hint:
Basically, if user search is not available just revert behaviour of CCSMIdentityService to before OPT-7403 was implemented.
Testing Notes:
If user search is not available in identity due to usage of https://github.com/camunda/product-hub/issues/739 , Optimize UI hides user search functionality (collections user tab, alerts, digests). See this comment on how to configure identity so that user search is not available: https://github.com/camunda-cloud/identity/issues/2304#issuecomment-1831589861
No error messages or issues using optimize especially accessing collections.
This is the controller panel for Smart Panels app
- is related to
-
OPT-7415 Show digest configuration modal in CCSM depending on UIConfiguration flag
- Done
-
OPT-5620 Optimize is integrated with Identity for user search (adding users to collections)
- Done
-
OPT-7403 Implement user search in BE for CCSM
- Done
-
OPT-7404 Enable collection user management tab in CCSM UI with new UIConfiguration flag
- Done