Groups membership support

[ntarocco]

The logged in user, in some organizations, might be a member of some groups that can be useful to define advanced authorization policy.
An example could be that the logged in user is admin of a specific Invenio community because (s)he belongs to a group "foo-community-admins".
The list of such groups for which the user is member of are normally not added to the authentication payload (it might be the case for some OAuth providers) but they have to be fetched after the authentication succeeded.

• The developer should be able to easily implement a post login hook to parse the auth payload to get the groups (some OAuth) or perform an extra call to fetch the groups. In case that this operation of retrieving groups is a long or complex or heavy operation, the developer should be able to trigger this in a async way.
• Since users and groups have to be searchable to define authorization when setting permissions (e.g. sharing), all organization users and groups should in Invenio DB. It should be easy for developers to implement a recurrent task that will sync users/groups and import them.
• Groups should simply become roles in Invenio when imported.

To read

• Users and groups: https://codimd.web.cern.ch/FkKsoasfQtGlIApR4m_osg#
• CERN specifics: https://codimd.web.cern.ch/GyeRhRCORumc-8ak0t26Jg#

Tasks

• Read and understand the doc of invenio-access about permissions.
• Change invenio-accounts role table:
  • The primary key should be an unique ID, non-autoincrement. This is because it can be set by the external identity provider when fetching groups externally. Two cases here:
    1. The primary key value could come from the external groups database, which has stable-unique IDs per group.
    2. When local role (managed by Invenio), it should probably be a randomly generated UUID.
  • Add the new db col is_managed.
  • Mare sure that created/updated columns are there.
  • Fix foreign key, tests, etc...
• invenio-users-resources:
  • Change the GroupsAggregator and groups code in invenio-users-resources (currently is_managed is hardcoded to True). This has to be changed. The new groups should be indexed in OpenSearch.
  • Change the hooks to avoid the creation of a celery task per user and group, but rather one celery task with all the users and another celery task with all the groups. Think about any possible issue here.
  • Make sure that it is easy to re-index all roles, found in the DB, in OpenSearch, in case something goes wrong.
• invenio-oauthclient:
  • add a new handler, after login, to get or fetch user's. This might be an expensive operation! A developer might want to do this sync or async, to avoid blocking the authentication flow with an HTTP request timeout
  • when all the user groups are fetched:
    1. new user's groups, now yet existing in the roles table, should be inserted - groups in OpenSearch must be re-indexed
    2. the table userroles should be updated, so that the logged in user will have all fetched roles. To do that, we should:
    • insert missing user <-> role
    • delete the previously existing user <-> role for which the role is not any more in the user's fetched groups
    3. on login, the groups of the logged in user should be added to the session if possible and not persisted to the DB. This is to avoid leaking to sysadmins if a user belongs to a group, by checking the DB. This has to be tested well, e.g. make sure that a user, member of a group set as community's owner, is owner of the community. It looks like that invenio-communities needs to be changed: the roles in the current user session should also be added as, now, only the user.roles (the ones in the users-roles table) are taken into account.

Only roles for which is_managed is False (not managed by Invenio) should be touched. Internally managed roles are instead managed via Invenio CLI. We should double-check that the Invenio CLI will not touch the is_managed:False roles.

WIP PRs

• Invenio-Accounts: wip: change roles db table invenio-accounts#432
• Invenio-OAuthclient: wip: groups handler invenio-oauthclient#290