diff --git a/INSTALL.md b/INSTALL.md index be67fd19a..48b5eba08 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -422,15 +422,23 @@ $ cd lib/Doctrine $ php deploy/DeployRequiredDataRunner.php requiredData ``` -### Deploy Sample Data +### OPTIONAL: Deploy Sample Data -Optional - you can deploy some sample data to seed your DB with sample users, -sites and services. +You can choose to deploy some sample data to seed your DB with sample users, +sites and services. Two sample data sets are available. Choose one of - -```bash -$ cd lib/Doctrine -$ php deploy/DeploySampleDataRunner.php sampleData -``` +1. Minimal - just enough to get going with no real-world associations. + + ```bash + $ cd lib/Doctrine + $ php deploy/DeploySampleDataRunner.php simpleSampleData + ``` +1. "Real World" - a small subset derived from real data. + + ```bash + $ cd lib/Doctrine + $ php deploy/DeploySampleDataRunner.php sampleData + ``` ### ORACLE ONLY: Deploy an existing DB .dmp file to populate your DB diff --git a/config/RoleActionMappings.xml b/config/RoleActionMappings.xml index 6f7f7978a..4fbc1724f 100644 --- a/config/RoleActionMappings.xml +++ b/config/RoleActionMappings.xml @@ -12,33 +12,33 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -@author David Meredith +@author David Meredith --> - + xsi:schemaLocation='http://goc.egi.eu/2015/03/spec1.0_r1 ./RoleActionMappingsSchema.xsd'> - - - + + + Service Group Administrator - + COD Staff COD Administrator EGI CSIRT Officer Chief Operations Officer - + @@ -49,17 +49,17 @@ Regional First Line Support - + Site Administrator Site Security Officer Site Operations Deputy Manager Site Operations Manager - + + The listed Roles enable the Actions over the target object(s). + --> @@ -72,25 +72,25 @@ ACTION_REJECT_ROLE ACTION_REVOKE_ROLE - ServiceGroup + ServiceGroup - + - + ACTION_EDIT_OBJECT ACTION_GRANT_ROLE ACTION_REJECT_ROLE ACTION_REVOKE_ROLE - - Project + + Project @@ -135,112 +135,113 @@ - + - - + + - - - - - - - + + + + + + + ACTION_EDIT_OBJECT - ACTION_SITE_ADD_SERVICE + ACTION_SITE_ADD_SERVICE ACTION_SITE_DELETE_SERVICE - - Site - - + ACTION_READ_PERSONAL_DATA + + Site + + - + - - + + - - - - - + + + + + ACTION_GRANT_ROLE - ACTION_REJECT_ROLE + ACTION_REJECT_ROLE ACTION_REVOKE_ROLE - - Site - - + + Site + + + - - + - - - + + + - - + + ACTION_SITE_EDIT_CERT_STATUS - - Site - - + + Site + + - - + - - - + + diff --git a/config/RoleActionMappingsSchema.xsd b/config/RoleActionMappingsSchema.xsd index a78fbcde4..f9207a0ee 100644 --- a/config/RoleActionMappingsSchema.xsd +++ b/config/RoleActionMappingsSchema.xsd @@ -12,103 +12,103 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -@author David Meredith ---> +@author David Meredith +--> - + attributeFormDefault="unqualified"> . It defines one -s. The mapping defines a set of role-action mapping rules -that apply to all projects in the DB. A single declares which -Actions the different Role types enable over the different types of target object. +The root element is . It defines one +s. The mapping defines a set of role-action mapping rules +that apply to all projects in the DB. A single declares which +Actions the different Role types enable over the different types of target object. Domain Model ------------ -The domain model is hierarchical; a parent object links to child objects in a -tree like structure. It is not a strict tree since many-to-many -relationships can exist, e.g. between Project and NGI where a single Project can -link many child NGIs while a single NGI can link to many parent Projects. +The domain model is hierarchical; a parent object links to child objects in a +tree like structure. It is not a strict tree since many-to-many +relationships can exist, e.g. between Project and NGI where a single Project can +link many child NGIs while a single NGI can link to many parent Projects. The basic domain model is illustrated below: -- Users own Roles of different types (r1,r2,r3...) that are held over/link-to - OwnedEntity (OE) implementations. -- The multiplicity of the relationships between domain objects is: - '1' = one, '*' = many +- Users own Roles of different types (r1,r2,r3...) that are held over/link-to + OwnedEntity (OE) implementations. +- The multiplicity of the relationships between domain objects is: + '1' = one, '*' = many - r1->Project(OE) UserA owns: r1,r2,r3,r4,r5,r6 - |* - |* - r2->Ngi(OE) - |1 + r1->Project(OE) UserA owns: r1,r2,r3,r4,r5,r6 + |* + |* + r2->Ngi(OE) + |1 |* r3->Site(OE) ServiceGroup(OE)<-r5,r6 |1 /1 |* /* r4->Service - |1 \1 - |* | + |1 \1 + |* | EndpointLoc | - \* |* + \* |* \* Downtime -The role-action mappings for a particular project propagate to all its children +The role-action mappings for a particular project propagate to all its children ------------------------------------------------------------------------------- If a domain object is 'reachable' from a project by navigating down through -the OE object graph, this object and all its descendents become subject to the -mapping rules of that particular project. For example: +the OE object graph, this object and all its descendents become subject to the +mapping rules of that particular project. For example: - p1 p2 Domain graph: p = project, n = ngi, s = site - | | - n1 n2 Each project's role-action-mappings are defined separately. - | | - s1 s2 + p1 p2 Domain graph: p = project, n = ngi, s = site + | | + n1 n2 Each project's role-action-mappings are defined separately. + | | + s1 s2 n1 gets linked to p2, n1 and s1 then become subject to the role action mapping - rules of both p1 and p2: + rules of both p1 and p2: - p1 p2 The role-action mappings for a particular project propagate to all - | / | children (p2's mapping rules apply to n1,n2,s1,s2). - n1 n2 - | | - s1 s2 + p1 p2 The role-action mappings for a particular project propagate to all + | / | children (p2's mapping rules apply to n1,n2,s1,s2). + n1 n2 + | | + s1 s2 Sample Instance Document ------------------------ - + xsi:schemaLocation='http://goc.egi.eu/2015/03/spec1.0_r1 ../../../../config/RoleActionMappingsSchema.xsd'> - - + RoleH @@ -116,7 +116,7 @@ Sample Instance Document RoleN - + @@ -142,22 +142,22 @@ Sample Instance Document site - + ]]> - + - + - + elements. The basic structure of the element is as follows: +the nested elements. The basic structure of the element is as follows: - - (0..*) - (0..*) - + + (0..*) + (0..*) + ]]> - + @@ -186,28 +186,28 @@ the nested elements. The basic structure of the element is as fo - applies to. -There can be only one that does not define any - elements, and this serves as the default. + applies to. +There can be only one that does not define any + elements, and this serves as the default. ]]> - + - + --> - + - - @@ -222,21 +222,21 @@ There can be only one that does not define any - elements. + elements. ]]> - + - - + @@ -246,19 +246,19 @@ The id attribute is used to reference this role name throughout the document. - - + + - + - + - - + @@ -268,11 +268,30 @@ specified target object(s), i.e. it actually defines the role-to-action mapping. - - + + + + + + + + + + + + + + + + + + + + + - + @@ -281,14 +300,24 @@ specified target object(s), i.e. it actually defines the role-to-action mapping. - + - + + + + + + + + + + + @@ -298,21 +327,23 @@ specified target object(s), i.e. it actually defines the role-to-action mapping. - - + - - - - - - + + + + + + + + - - - + + + diff --git a/config/gocdb_schema.xml b/config/gocdb_schema.xml index 3a87b0911..3077c58c2 100644 --- a/config/gocdb_schema.xml +++ b/config/gocdb_schema.xml @@ -606,5 +606,9 @@ 255 /^(X509|OIDC Subject)$/ + + ALLOW_WRITE + boolean + diff --git a/config/local_info.xml b/config/local_info.xml index a477e1a56..d804c7652 100755 --- a/config/local_info.xml +++ b/config/local_info.xml @@ -186,6 +186,17 @@ order of tokens in MyConfig1 if user has multiple identifiers --> false + + false +
@@ -108,52 +111,62 @@
- - Users (Click on name to manage roles) - - - 0): ?> - - - - - - - - - - + + + Users (Click on name to manage roles) + + + 0) { ?> +
NameRole
+ - - - + + + + + - -
- - - - - getUser()->getFullName()?> - - - - getRoleType()->getName()); } else {echo('PROTECTED'); } ?> - NameRole
-
    There are currently no users with roles over this project
"; endif; ?> + + + + + + + + getUser()->getFullName()?> + + + + + getRoleType()->getName()); } else {echo('PROTECTED'); } ?> + + + + + +
    There are currently no users with roles over this project
"; + } + } else { + require_once __DIR__.'/../fragments/hidePersonalData.php'; + } + ?> - + diff --git a/htdocs/web_portal/views/service/view_service.php b/htdocs/web_portal/views/service/view_service.php index 5c77446f4..1d4efe983 100644 --- a/htdocs/web_portal/views/service/view_service.php +++ b/htdocs/web_portal/views/service/view_service.php @@ -1,12 +1,12 @@ getParentSite()->getName(); $extensionProperties = $se->getServiceProperties(); $seId = $se->getId(); $configService = \Factory::getConfigService(); +$showPD = $params['authenticated']; ?>
@@ -51,44 +51,44 @@ @@ -114,9 +114,9 @@ diff --git a/htdocs/web_portal/views/service/view_service_endpoint.php b/htdocs/web_portal/views/service/view_service_endpoint.php index 724578ba2..0944b428e 100644 --- a/htdocs/web_portal/views/service/view_service_endpoint.php +++ b/htdocs/web_portal/views/service/view_service_endpoint.php @@ -1,5 +1,6 @@ getService(); $extensionProperties = $endpoint->getEndpointProperties(); $epId = $endpoint->getId(); @@ -86,7 +87,15 @@ - + diff --git a/htdocs/web_portal/views/service_group/view_sgroup.php b/htdocs/web_portal/views/service_group/view_sgroup.php index 03cd4f402..9a4961486 100644 --- a/htdocs/web_portal/views/service_group/view_sgroup.php +++ b/htdocs/web_portal/views/service_group/view_sgroup.php @@ -1,5 +1,8 @@ getServiceGroupProperties(); +$showPD = $params['authenticated']; ?> @@ -41,7 +44,7 @@ - +
@@ -81,11 +84,11 @@
Host name - getHostName()); - } else echo('PROTECTED - Registration required'); ?> + } else echo(getInfoMessage()); ?>
IP Address - getIpAddress()); - }else echo('PROTECTED - Registration required'); ?> + } else echo(getInfoMessage()); ?>
IP v6 Address - getIpV6Address()); - } else echo('PROTECTED - Registration required'); ?> + } else echo(getInfoMessage()); ?>
Operating System - getOperatingSystem()); - } else echo('PROTECTED - Registration required'); ?> + } else echo(getInfoMessage()); ?>
Architecture - getArchitecture()); - } else echo('PROTECTED - Registration required'); ?> + } else echo(getInfoMessage()); ?>
Contact E-Mail - getEmail()); - } else echo('PROTECTED - Registration required'); ?> + getEmail()); + } else echo(getInfoMessage()); ?>
Host DN
- getDn()) ; - } else echo('PROTECTED - Registration required'); ?> + } else echo(getInfoMessage()); ?>
IdgetId() ?>
Contact E-mailgetEmail() ?>Contact E-mail + getEmail()); + } else { + echo getInfoMessage(); + } + ?> +
Monitored
Contact E-Mail - + getEmail()); ?> - +
@@ -174,43 +177,44 @@
- Users (Click on name to manage roles) - - - - - - - - - + + + +
NameRole
-
- - + + Users (Click on name to manage roles) + + + + + + + + + - - - -
NameRole
+ - - getRoleType()->getName()) ; - } else {echo 'PROTECTED'; } - ?> -
+
+
+ getRoleType()->getName()); ?> +
+ - +
diff --git a/htdocs/web_portal/views/site/add_api_auth.php b/htdocs/web_portal/views/site/add_api_auth.php index 005e710ac..675734656 100644 --- a/htdocs/web_portal/views/site/add_api_auth.php +++ b/htdocs/web_portal/views/site/add_api_auth.php @@ -1,19 +1,32 @@

Add new API credential to getName());?>

-
- Caution: it is possible to delete information using the write functionality of the API. -
+

The credential added will be linked to GOCDB account + + getForename()." ".$params['user']->getSurname())?> + +

- Identifier (e.g. Certificate DN or OIDC Subject)* - -
- Credential type* - -
+
+ Identifier (e.g. Certificate DN or OIDC Subject)* + +
+
+ Credential type* + +
+
+ Caution: it is possible to delete information using the write functionality of the API.
+
+ + /> + +
+
diff --git a/htdocs/web_portal/views/site/delete_api_auth.php b/htdocs/web_portal/views/site/delete_api_auth.php index e7f143f26..cd41913bd 100644 --- a/htdocs/web_portal/views/site/delete_api_auth.php +++ b/htdocs/web_portal/views/site/delete_api_auth.php @@ -6,7 +6,7 @@

Delete API Authentication Credential


You are about to delete the following API authorisation credential:
- Creedential identifier: getIdentifier());?>
+ Credential identifier: getIdentifier());?>
Credential type: getType());?>
Site Name: getName());?>

diff --git a/htdocs/web_portal/views/site/edit_api_auth.php b/htdocs/web_portal/views/site/edit_api_auth.php index f30848efb..9663b898b 100644 --- a/htdocs/web_portal/views/site/edit_api_auth.php +++ b/htdocs/web_portal/views/site/edit_api_auth.php @@ -1,19 +1,72 @@
-

Edit API credential for getName());?>

-
-
- Identifier (e.g. Certificate DN or OIDC Subject)* - -
- Credential type* - -
+ getUser(); + + echo('

Edit API credential for '); + xecho($params['site']->getName()); + echo('

'); + + if (!is_null($entUser)) { + + echo('

This credential is linked to GOCDB user '); + echo(''); + xecho($entUser->getFullname()); + echo('

'); + + // entities created prior to GOCDB5.8 have a null owning user + if ($entUser->getId() != $user->getId()) { + echo('
'); + echo("WARNING: editing will change the linked user from '"); + xecho($entUser->getFullname()); + echo("' to '"); + xecho($user->getFullname()); + echo("'. Click the browser Back button to cancel the edit.
"); + } + + } else { + // This clause should be deleted or replaced with exception after all + // authentication entities are assigned a user. + echo('
'); + echo("WARNING: editing will link user '"); + xecho($user->getFullname()); + echo("' to this credential. Click the browser Back button to cancel the edit.
"); + } + ?> + +
+ Identifier (e.g. Certificate DN or OIDC Subject)* + +
+
+ Credential type* + +
+
+
+ WARNING: it is possible to delete information using the write functionality of the API. Leave Allow API write unchecked if + you do not need to write data. +
+
+ getAllowAPIWrite()) { echo('checked="checked"');} + ?> + /> + +
+
diff --git a/htdocs/web_portal/views/site/view_site.php b/htdocs/web_portal/views/site/view_site.php index 538bcd8f3..32ab5f00a 100644 --- a/htdocs/web_portal/views/site/view_site.php +++ b/htdocs/web_portal/views/site/view_site.php @@ -1,9 +1,12 @@ getNgi()->getName(); $portalIsReadOnly = $params['portalIsReadOnly']; $extensionProperties = $site->getSiteProperties(); +$showPD = $params['authenticated']; // display Personal Data ?>
@@ -54,65 +57,65 @@ @@ -147,14 +150,14 @@ @@ -199,21 +202,21 @@ @@ -221,10 +224,10 @@ @@ -232,10 +235,10 @@ @@ -243,10 +246,10 @@ @@ -261,10 +264,10 @@ @@ -272,10 +275,10 @@ @@ -283,10 +286,10 @@ @@ -294,10 +297,10 @@ @@ -305,10 +308,10 @@ @@ -434,54 +437,53 @@
- Users (Click on name to manage roles) - -
E-Mail - + getEmail()) ?> - +
TelephonegetTelephone()); } else - echo('PROTECTED - Registration required'); + echo(getInfoMessage()); ?>
Emergency TelgetEmergencyTel()); } else - echo('PROTECTED - Registration required'); + echo(getInfoMessage()); ?>
CSIRT TelgetCsirtTel()); } else - echo('PROTECTED - Registration required') + echo(getInfoMessage()) ?>
CSIRT E-Mail - + getCsirtEmail()) ?> - +
Emergency E-Mail - + getEmergencyEmail()) ?> - +
Helpdesk E-Mail - + getHelpdeskEmail()) ?> - +
Certification Status - + getCertificationStatus()->getName()) ?>   Change - +
Home URL - + getHomeUrl()) ?> - +
GIIS URL getGiisUrl()); } else - echo('PROTECTED - Registration required'); + echo(getInfoMessage()); ?>
IP Range getIpRange()); } else - echo('PROTECTED - Registration required'); + echo(getInfoMessage()); ?>
IP v6 Range getIpV6Range()); } else - echo('PROTECTED - Registration required'); + echo(getInfoMessage()); ?>
Domain getDomain()); } else - echo('PROTECTED - Registration required'); + echo(getInfoMessage()); ?>
Country getCountry()->getName()); } else { - echo 'PROTECTED'; + echo getInfoMessage(); } ?>
Latitude getLatitude()); } else { - echo 'PROTECTED'; + echo getInfoMessage(); } ?>
Longitude getLongitude()); } else { - echo 'PROTECTED'; + echo getInfoMessage(); } ?>
Time Zone getTimezoneId()); } else { - echo 'PROTECTED'; + echo getInfoMessage(); } ?>
Location getLocation()); } else { - echo 'PROTECTED'; + echo getInfoMessage(); } ?>
- - - - - - - - - - - - - - -
NameRole
- - - getRoleType()->getName()); - } else { - echo 'PROTECTED'; - } - ?> -
+ + Users (Click on name to manage roles) + + + + + + + + + + + + + + + + +
NameRole
+ + + getRoleType()->getName()); + ?> +
+ '; + echo 'User personal data is hidden (' . getInfoMessage() . ') '; + echo ''; + } + ?> - +
@@ -553,40 +555,77 @@
@@ -181,7 +195,8 @@ Role Type Held Over - Revoke Role + Revoke Role + - - getDecoratorObject() != null):?> -
- - -
- + + getDecoratorObject(); + if(!$params['portalIsReadOnly'] && $decorator != null) { + echo '
'; + echo ""; + echo ""; + echo '
'; + }; + ?> + + + - + title="Your roles allowing revoke: " > @@ -330,7 +356,46 @@ ?>
- + isEmpty()) { ?> + +
+ + Owned API Credentials (Add and remove credentials by clicking the relevant Site.) + + + + + + + + + + + + + + + + + +
TypeIdentifierSiteAPI Write
getType());?>getIdentifier());?> + + getParentSite()->getShortName(),0,16));?> + + + getAllowAPIWrite())) { + echo '"'.\GocContextPath::getPath().'img/tick.png"'; + } else { + echo '"'.\GocContextPath::getPath().'img/cross.png"'; + } ?> + /> +
+
+