Is it possible to set the default space for new users to "All spaces" instead of "Default space"?
For config:
para.auto_assign_spaces = "ScopeA,ScopeB"New users are assigned to the above spaces, as well as the "Default space" which is set as the default.
I noticed that many new users do not notice the spaces and leave Scoold thinking that there are no interesting topics there.
Setting default to "All spaces" wuold help them to explore more after first signin.
@albogdano Awesome! :thumbsup:
I'm wondering how to make the Spaces button more obvious.
I asked a few users and they said that at first they thought of it as a separator between the application menu and the user menu.
Maybe enlarging it to the size of the adjacent user menu would make the button more noticeable.
If I come up with something I'll share.
Until then I'll just pin a question with a brief description of Scoold's basic functions, that should help.
para.security.oauth.admins_equivalent_claim_value will add admin rights after signin.
I got this on pull:
1.48.1: Pulling from scoold-pro
97518928ae5f: Already exists
170a48b9dc73: Already exists
5de6f17ec67d: Already exists
7a15738aa7d2: Pulling fs layer
17e6d4d1b69e: Verifying Checksum
filesystem layer verification failed for digest sha256:17e6d4d1b69e5e43e1cd761918a7f56b5e74ea43b19fb0437fa95f021a3fdf71Still no success with oauth.groups.
I changed the configuration like this:
para.security.oauth.groups_attribute_name = "/attributes/MemberOf"
para.security.oauth.admins_equivalent_claim_value = ".*?USER_SCOOLD.*"
para.security.oauth.users_equivalent_claim_value = ".*?USER_xxx_SCOOLD.*"Signed in multiple times as user which in /attributes/MemberOf array has:"CN=USER_SCOOLD,CN=SCOOLD,CN=Groups,O=COMPANY"
As a result, I was able to access Scoold at the user level every time.
The expected result is a sign in error due to missing .*?USER_xxx_SCOOLD.*, but it never occured.
Alternatively, administrator privileges should be granted, but they were not.
Since nothing happens I suspect the problem is in para.security.oauth.groups_attribute_name = "/attributes/MemberOf".
Which logs can I switch to trace whats going on with OIDC auth process in Scoold?
With default levels there is nothing in logs about signing in.
The only lines in Para's log worth noting are:
2022-02-10 12:45:23 [WARN ] null
com.nimbusds.jose.KeyLengthException: The secret length must be at least 256 bits
at com.nimbusds.jose.crypto.impl.MACProvider.<init>(MACProvider.java:118)
at com.nimbusds.jose.crypto.MACVerifier.<init>(MACVerifier.java:168)
at com.nimbusds.jose.crypto.MACVerifier.<init>(MACVerifier.java:81)
at com.nimbusds.jose.crypto.MACVerifier.<init>(MACVerifier.java:97)
at com.erudika.para.server.security.SecurityUtils.isValidJWToken(SecurityUtils.java:225)
at com.erudika.para.server.security.filters.PasswordlessAuthFilter.getOrCreateUser(PasswordlessAuthFilter.java:115)
at com.erudika.para.server.security.JWTRestfulAuthFilter.getOrCreateUser(JWTRestfulAuthFilter.java:313)
...
2022-02-10 12:45:23 [TRACE] Invoking JWTRestfulAuthFilter (22/28)
2022-02-10 12:45:23 [DEBUG] Checking match of request : '/v1/_id/6202552ce54b5b05c40cf670:profile'; against '^/v\d[\.\d]*/.*'
2022-02-10 12:45:23 [TRACE] Invoking RestAuthFilter (23/28)
2022-02-10 12:45:23 [DEBUG] Checking match of request : '/v1/_id/6202552ce54b5b05c40cf670:profile'; against '^/v\d[\.\d]*/.*'
2022-02-10 12:45:23 [TRACE] Invoking RememberMeAuthenticationFilter (24/28)
2022-02-10 12:45:23 [DEBUG] SecurityContextHolder not populated with remember-me token, as it already contained: 'com.erudika.para.server.security.AppAuthentication@149545c2'I can prowide full stacktrace if it would help.
{
"sub": "username",
"auth_time": 1531571734,
"attributes": {
"Office": "Full office name",
"CN": "User Name",
"credentialType": "Type",
"DisplayName": "User Name (Office)",
"DN": "uid=username,CN=Users,O=COMPANY",
"Email": "username@company.com",
"FN": "Firstname",
"MemberOf": [
"CN=UX_some_role,CN=UXUSER,CN=UX,CN=Groups,O=COMPANY",
"CN=confluence-users,CN=CF_PROD,CN=CF,CN=Groups,O=COMPANY",
"CN=wiki_space_pcpzu_edytor,CN=CF_PROD,CN=CF,CN=Groups,O=COMPANY",
"CN=USER_xxx_SCOOLD,CN=SCOOLD,CN=Groups,O=COMPANY",
"CN=OTHER_SUPERUSER,CN=OTHER,CN=OS,CN=Groups,O=COMPANY"
],
"Name": "username",
"LN": "Lastname",
"UID": "username"
},
"id": "username"
}MemberOf object contains both the admins role USER_SCOOLD and USER_xxx_SCOOLD then you will be given the admin rights and you will be able to sign in
para.security.oauth2.token_delegation_enabled = true
:latest tag and you should see a debug message about the values of the returned OAuth2 access tokens and Id tokens. based on that we can debug the situation.Scoold will merged the values of the ID token into the access token so the two payloads are combined into one object. Then Scoold will try to parse that object and find the appropriate groups
if for some reason the MemberOf object contains both ...
USER_xxx_SCOOLD does not exists, it's purposefully prepared for Scoold config to make sure it does not exists in MemberOf.
if for some reason your account is an admin account ...
It's not. Double checked, even removed para.admins from config. Also removing user (from UI by other admin user) has no effect on recreated perms.
also make sure that you have
para.security.oauth2.token_delegation_enabled = true
It is set to true.
update Para to the
:latesttag
Would be great to have Para :latest-base to test on existing test env as much as possible close to production (config/elastic/mongo).
If it's a hassle, I'll setup new test env with :latest.
Also can't start
para:latest-base with para-dao-mongodb:1.37.1 and para-search-elasticsearch:1.38.2, Para is reseting with stack:Exception in thread "main" java.lang.reflect.InvocationTargetException
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
... 7 more
Caused by: java.util.ServiceConfigurationError: com.erudika.para.core.search.Search: Provider com.erudika.para.server.search.ElasticSearch could not be instantiated
at java.base/java.util.ServiceLoader.fail(Unknown Source)
at java.base/java.util.ServiceLoader$ProviderImpl.newInstance(Unknown Source)
at java.base/java.util.ServiceLoader$ProviderImpl.get(Unknown Source)
at java.base/java.util.ServiceLoader$3.next(Unknown Source)
at com.erudika.para.server.search.SearchModule.loadExternalSearch(SearchModule.java:55)
at com.erudika.para.server.search.SearchModule.configure(SearchModule.java:34)
at com.google.inject.AbstractModule.configure(AbstractModule.java:64)
at com.google.inject.spi.Elements$RecordingBinder.install(Elements.java:409)
at com.google.inject.spi.Elements.getElements(Elements.java:108)
at com.google.inject.internal.InjectorShell$Builder.build(InjectorShell.java:160)
at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:107)
at com.google.inject.Guice.createInjector(Guice.java:87)
at com.erudika.para.server.ParaServer.initialize(ParaServer.java:139)
at com.erudika.para.server.ParaServer.runAsJAR(ParaServer.java:424)
at com.erudika.para.server.ParaServer.main(ParaServer.java:433)
at com.erudika.para.jar.Run.main(Run.java:28)
... 8 more
Caused by: java.lang.NoSuchMethodError: 'boolean com.erudika.para.core.utils.Config.isSearchEnabled()'
at com.erudika.para.server.search.ElasticSearch.<clinit>(ElasticSearch.java:104)
... 27 moreConfig class