...

The CoreOne Suite offers an extensive access management. In the domain of this access management, permissions are called resource assignments. So whenever Whenever an administrator is assigning a resource in the Admin UI, when a user receives resources through a assignment rule, or someone uses the self-service portal to delegate a service permission or a service permission of a company to someone else, those permissions are stored in the access management space as resource assignments.

From here, those resource assignments are then provisioned to the CoreOne Authentication serviceService. While provisioning, assignment context and other transformations can be applied. With those transformations, application specific information can be added. Whenever a user then authenticates himself for a given application, those provisioned resource assignments are exposed to the application as part of the access token. This is either through the roles or the roles_with_context claim. The later is used whenever a resource assignment has a context. For example someone has the right to submit taxes for the company ITSENSE. The company ITSENSE represents the context.

There are use cases where those permission need to be available to the application even if the user is not present (offline access) or if the application needs to know permissions of other users or other entities (companies, users). In those cases, the permission API of the CoreOne Authentication Service can be used.

It is important to note that calls to api/permission do not read the access management space (IAM space) but the actually provisioned resources at the CoreOne Authentication Service (IdP space). For example if a user has access to a role, but that assignment was paused, the assignment will show up in the IAM space (resource assignment) but is not provisioned to the CoreOne Authentication Service (IdP space) and will not show up over the permission API, as the user currently does not have that permission.

Base URL

The base URL for the permission API is as following:

{authentication service url}/api

Endpoints

There are two different endpoints. Depending on your use case, you might choose either one of those.

Generic permissions

Available from version 8.0 and upwards.

{authentication service url}/api/permission

To access this endpoint, you need to have the CoreOne Authentication Service API Read Permissions for any Application assigned to your user. The endpoint itself can return all permission of all applications.

Application Specific Permissions

Available from version 9.0.3 and upwards.

{authentication service url}/api/permission/myapplication

To access this endpoint, you need to have the CoreOne Authentication Service API Read Permissions for My Application assigned to your user. The endpoint itself only returns permissions associated to client calling the endpoint, thus restricting the permissions. In most use cases it’s advised to use this endpoint.

Authentication

In order to access the API, you will need to configure an appropriate client of the CoreOne Suite application and assign the cos_auth_api scope. Additionally you will need an appropriate user with permissions to access the data, that’s either the CoreOne Authentication Service API Read Permissions for any Application or the CoreOne Authentication Service API Read Permissions for My Application resource. Authentication then is done by passing a bearer token in each request. Also note that in order to receive the email address of a user, the client needs to have access to the email scope.

Data Objects

Permission

All the endpoints return a permission object which looks as following:

{
    "$type": "iTsense.CoreLogin2.Server.API.Models.PermissionApiDto, iTsense.CoreLogin2.Server",
    "username": "max@dax.ch",
    "userId": 17173,
    "userEmail": "max@dax.ch",
    "role": "TrusteeApp_AddBill",
    "application": "Trustee Test Application",
    "contextType": "OrganizationUnit",
    "contextObjectIdentifier": "5445"
}

Use Cases

...

For our use cases we have trustee management app, where a user can add, remove and approve bills. So the application has three rights: add, remove and approve.

Read who has rights for a user

If you would like to read who is representing a specific user (Peter Pan, 17175), you can perform the following query:.

{authentication service url}/api/permission?contextType=User&contextObjectIdentifier=17175&application=trusteeApp

or

{authentication service url}/api/permission/myapplication?contextType=User&contextObjectIdentifier=17175

Example result

[
    {
        "$type": "iTsense.CoreLogin2.Server.API.Models.PermissionApiDto, iTsense.CoreLogin2.Server",
        "username": "peter@pan.de",
        "userId": 17175,
        "userEmail": "peter@pan.de",
        "role": "TrusteeApp_AddBill",
        "application": "trusteeApp",
        "contextType": "User",
        "contextObjectIdentifier": "17175"
    },
    {
        "$type": "iTsense.CoreLogin2.Server.API.Models.PermissionApiDto, iTsense.CoreLogin2.Server",
        "username": "peter@pan.de",
        "userId": 17175,
        "userEmail": "peter@pan.de",
        "role": "TrusteeApp_RemoveBill",
        "application": "trusteeApp",
        "contextType": "User",
        "contextObjectIdentifier": "17175"
    },
    {
        "$type": "iTsense.CoreLogin2.Server.API.Models.PermissionApiDto, iTsense.CoreLogin2.Server",
        "username": "peter@pan.de",
        "userId": 17175,
        "userEmail": "peter@pan.de",
        "role": "TrusteeApp_ApproveBill",
        "application": "trusteeApp",
        "contextType": "User",
        "contextObjectIdentifier": "17175"
    },
    {
        "$type": "iTsense.CoreLogin2.Server.API.Models.PermissionApiDto, iTsense.CoreLogin2.Server",
        "username": "max@dax.ch",
        "userId": 17173,
        "userEmail": "max@dax.ch",
        "role": "TrusteeApp_AddBill",
        "application": "trusteeApp",
        "contextType": "User",
        "contextObjectIdentifier": "17175"
    },
    
]

Notice the first three entries are the permissions the user has himself, and the fourth one is another person who received this right to add bills in Peters name via delegation.

Read who represents a company

If you would like to read who is representing a specific company, you can perform the following query:.

{authentication service url}/api/permission?contextType=OrganizationUnit&contextObjectIdentifier=5445&application=trusteeApp

or

{authentication service url}/api/permission/myapplication?contextType=OrganizationUnit&contextObjectIdentifier=5445

Example Result

[
    {
        "$type": "iTsense.CoreLogin2.Server.API.Models.PermissionApiDto, iTsense.CoreLogin2.Server",
        "username": "max@dax.ch",
        "userId": 17173,
        "userEmail": "max@dax.ch",
        "role": "TrusteeApp_AddBill",
        "application": "trusteeApp",
        "contextType": "OrganizationUnit",
        "contextObjectIdentifier": "5445"
    },
    {
        "$type": "iTsense.CoreLogin2.Server.API.Models.PermissionApiDto, iTsense.CoreLogin2.Server",
        "username": "max@dax.ch",
        "userId": 17173,
        "userEmail": "max@dax.ch",
        "role": "TrusteeApp_Approver",
        "application": "trusteeApp",
        "contextType": "OrganizationUnit",
        "contextObjectIdentifier": "5445"
    }
]

Read which other entities a user represents

If you would like to read who a user is representing, you can perform the following query.

{authentication service url}/api/permission?application=Trustee Test Application&userSubject=c1s:17173

or

{authentication service url}/api/permission/myapplication?userSubject=c1s:17173