Role everyone incorrectly set in set_all_auth_role

[Martin Vogel]

The playbook connections-restrict-access.yml modifies for role everyone the default mapping from everyone to All Authenticated in Application's Realm

The Connections documentation (https://help.hcltechsw.com/connections/v7/admin/admin/r_admin_common_user_roles.html) says about the Everyone role:

Users with this role can access public pages without signing in to the application. The login page is an example of a page that allows such access.

Do not change the default mapping for this role because it is used internally by HCL Connections. Changing the mapping might affect the ability to log in to the application.

Therefore the setting for everyone should be yes and the allauth variables should be empty.

 - { __role: "everyone", __everyone: "yes", __allauth: '""', __users: '""', __groups: '""', __allauth_trusted: '""', __mappeduseraccessids: '""', __mappedgroupaccessids: '""' } 

connections-automation/roles/hcl/connections/set_all_auth_role/tasks/main.yml

Lines 14 to 31 in f23269a

 - name:                      Update applications J2EE reader role to All Authenticated (Blogs, Dogear, Homepage, Search) 
   include_role: 
     name:                    roles/third_party/ibm/wasnd/was-dmgr-j2ee-role-update 
   vars: 
     __app:                   "{{ item }}" 
     __role_mapping_prop: 
       - { __role: "person", __everyone: "no", __allauth: "{{ __allauth_value }}", __users: '""', __groups: '""', __allauth_trusted: "{{ __allauth_trusted_value }}", __mappeduseraccessids: '""', __mappedgroupaccessids: '""' } 
       - { __role: "reader", __everyone: "no", __allauth: "{{ __allauth_value }}", __users: '""', __groups: '""', __allauth_trusted: "{{ __allauth_trusted_value }}", __mappeduseraccessids: '""', __mappedgroupaccessids: '""' } 
       - { __role: "everyone", __everyone: "no", __allauth: "{{ __allauth_value }}", __users: '""', __groups: '""', __allauth_trusted: "{{ __allauth_trusted_value }}", __mappeduseraccessids: '""', __mappedgroupaccessids: '""' } 
       - { __role: "metrics-reader", __everyone: "no", __allauth: "{{ __allauth_value }}", __users: '""', __groups: '""', __allauth_trusted: "{{ __allauth_trusted_value }}", __mappeduseraccessids: '""', __mappedgroupaccessids: '""' } 
   with_items: 
     - Blogs 
     - Dogear 
     - Homepage 
     - Search 
   when: 
     restrict_reader_access is defined and restrict_reader_access|bool or 
     restrict_reader_access__trusted_realms is defined and restrict_reader_access__trusted_realms|bool 

[sabrina-yee]

This script is for the playbook to disable anonymous access. Therefore, the everyone role is set to "no". We'll review the related documentation to more accurately describe anonymous access. Thanks for feedback.

[Christoph Stoettner]

The everyone roles are needed to display the login form. If you set everyone to no, no login is possible!

To disable anonymous access, you have to set reader to authenticated.

From documentation:

You want to set reader, do not touch Everyone!

It is important, that the role reader should be changed from Everyone to Authenticated, but the everyone role has to be Everyone, or Login breaks. Even OIDC will break, because the forward rules end in 404.

[sabrina-yee]

We have been using this playbook for internal deployments including OIDC that's why I'd like the documentation to be reviewed to understand more about the discrepancy between automation requirements and documentation.

[paul.nott]

Closing this per pervious comments, the documentation to be reviewed to understand more about the discrepancy between automation requirements and documentation