feat(admin-ui): make page UI for cedarling configuration

[kdhttps]

Check Parent Issuer for more details on the new design.

[duttarnab]

Immediately, after Admin UI is installed, how users can login an see menus to configure the policy store url, without any policy-store defined?

[kdhttps]

Immediately, after Admin UI is installed, how users can login an see menus to configure the policy store url, without any policy-store defined?

By default, Cedarling auth is disabled, and the admin can see/access all things. It will only be active after configuration. Some of our customers may not need Cedarling, like say there is only one admin, then no need for Cedarling authz, so by default it will be disabled.

[duttarnab]

I think there should be a default policy store available after installation. If Cedarling authorization is disabled, it would add additional responsibility on users to create their own policy store, and many of them may not want this extra work.

I believe the installer should generate a default policy store that can be placed in persistence. The Admin UI can then access this policy store via the config API if no policy store URL is configured.

[kdhttps]

Please check this issue #2313. I have added instructions on how to configure/use the default policy store. I agree with you. We can provide the same configuration during installation, but let's get the thoughts of other members on this. cc @nynymike @moabu @ossdhaval

[ossdhaval]

I think there should be a default policy store available after installation. If Cedarling authorization is disabled, it would add additional responsibility on users to create their own policy store, and many of them may not want this extra work.

I believe the installer should generate a default policy store that can be placed in persistence. The Admin UI can then access this policy store via the config API if no policy store URL is configured.

Hi @duttarnab

I am wondering what purpose will this serve? The initial policy store that system would create will anyways do the same thing: Allow admin to do everything. And more over, this policy store in persistence will not be useful in anyway when admin wants to start using Cedarling for authz. So, in my view, simpler approach, suggested by @kdhttps, is better.

[duttarnab]

Hi @kdhttps

I have done backend changes described at JanssenProject/jans#12369

I have deployed the backend at duttarnab-shining-lynx.gluu.info. You can use it for UI testing.

[duttarnab]

Hi @ossdhaval

I am wondering what purpose will this serve? The initial policy store that system would create will anyways do the same thing: Allow admin to do everything. And more over, this policy store in persistence will not be useful in anyway when admin wants to start using Cedarling for authz. So, in my view, simpler approach, suggested by @kdhttps, is better.

After installing of the flex with Admin UI , the Admin UI will not be functional unless the user configures the remote policy-store url. Without the policy-store Admin UI will not be functional after login as policy-store will manage access control of GUI. Then how the administrator can save and activate the policy-store url if access control is not working? Kiran has plan to use the existing role-to-scopes mapping in Admin UI for initial access control, but I think the clean way would be to use a default policy-store for initial access-control.