Search code examples
moqui

Moqui Authorization

I am trying to access Moqui entities using REST API. Here is an the example call.

GET http://localhost:8080/rest/m1/products/default
Accept: application/application/json
Authorization: Basic am9obi5kb2U6bW9xdWk=

I am getting the following response

{
  "errorCode": 403,
  "errors": "User john.doe is not authorized for View on Entity mantle.product.Product"
}

However calls to mantle-usl services work fine as shown in following example

GET http://localhost:8080/rest/s1/mantle/facilities/
Accept: application/application/json
Authorization: Basic am9obi5kb2U6bW9xdWk=

[
  {
    "facilityId": "ZIRET_WH",
    "pseudoId": "ZIRET_WH",
    "facilityTypeEnumId": "FcTpWarehouse",
    "ownerPartyId": "ORG_ZIZI_RETAIL",
    "facilityName": "Ziziwork Retail Warehouse",
    "assetAllowIssueOverQoh": "Y",
    "lastUpdatedStamp": 1550661258932
  }
]

How do I allow a user to access entities using REST API?

Solution

  • Checkout https://www.moqui.org/m/docs/framework/Security#artifact-authz

    The following text is copied from Moqui documentation.

    The first step to configure artifact authorization is to create a group of artifacts. This involves a ArtifactGroup record and a ArtifactGroupMember record for each artifact, or artifact name pattern, in the group.

    For example here is the artifact group for the Example app with the root screen (ExampleApp.xml) as a member of the group:

    <moqui.security.ArtifactGroup artifactGroupId="EXAMPLE_APP" description="Example App (via root screen)"/>
<moqui.security.ArtifactGroupMember artifactGroupId="EXAMPLE_APP" artifactTypeEnumId="AT_XML_SCREEN" inheritAuthz="Y" artifactName="component://example/screen/ExampleApp.xml"/>

    If you are in hurry, read on.

    Try adding the following snipped in ExampleZzzDemoData.xml

    <moqui.security.ArtifactGroupMember artifactGroupId="EXAMPLE_APP" artifactName="mantle\..*"
                                        nameIsPattern="Y" artifactTypeEnumId="AT_ENTITY" inheritAuthz="Y"/>

    Note: This is not for a production system. It is a huge security risk to give access to all entities to a single role. Make sure you take time and plan authorization.