A branch exists in HydroShare that exports user/resource access control to a mongo collection and is deployed to beta.hydroshare.org. Setup listeners on the mongo collection change stream to:
- Add/remove discoverable resources from discovery
- Map user access control with resources that externally reference S3 resources to console.minio.cuahsi.io
That mongo database can be found on atlas at CUAHSI->CZNET->Cluster0->hydroshare_beta. The two collections to listen to are resourceaccess and userprivileges
Add/remove discoverable resources from discovery
Documents in the resourcesaccess collection look like:
{
"resource_id": "8bb057d9653c4abba8bb2e48fe3642ce",
"is_public": true,
"show_in_discover": true,
"minio_resource_url": "some url"
}
Only listen for documents that have "minio_resource_url": "Not null value
. Add/remove documents from discovery based on show_In_discover
.
Map user access control with resources that externally reference S3 resources to console.minio.cuahsi.io
Documents in the userprivileges collection look like:
{
"username": "sblack",
"all": {},
"minio": {
"owner": [
{
"owners": [
"sblack"
],
"resource_id": "8bb057d9653c4abba8bb2e48fe3642ce",
"minio_resource_url": "https://console.minio.cuahsi.io/browser/sblack/YXJnb193b3JrZmxvd3MvcGFyZmxvdy9kYzRlYWZkNi0yNTM0LTQwMjEtODNiZS1iZjM2YWNhNDhhMjIv"
}
],
"edit": [
{
"owners": [
"sblack-admin"
],
"resource_id": "b9ac783296cc4a93b8996247e120aa61",
"minio_resource_url": "https://console.minio.cuahsi.io/browser/sblack-admin/editable"
}
],
"view": [
{
"owners": [
"sblack-admin"
],
"resource_id": "b4c9b612f157452dbb6826aabeb15b0e",
"minio_resource_url": "https://console.minio.cuahsi.io/browser/sblack-admin/viewable"
}
]
}
}
The username is the user that the access control applies to. The all
property is a complete dump of all hydroshare resource privileges for the user, ignore it. The minio
property contains user privileges for resources that have an additional metadata key of minio_resource_url
and the value is copied to the mongo document. There are 3 lists; view, edit, owner. Each item in those lists has an owners property. The first owner maps to the bucket name. Resource_id is the hydroshare resource id. Minio_resource_url is the value in additional_metadata that points to a path on minio.
#JIRA=CAM-54