Giters

weavejester / ring-oauth2

OAuth 2.0 client middleware for Ring

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Help: how to allow a local administrator to bypass?

yatesco opened this issue · comments

commented

Our software ships with a magic administrator user who can do all things everywhere. Users who register via OAuth2 need to be accepted and mapped to internal permissions before they can actually log on.

Do you have any suggestions (other than "magic user? Urgh!") on how to accomplish this? Essentially I want to have a handler for all URLs which:

(defn- ensure-authentication [req]
  (if (magic-user-authenticated? req) continue...)
       (forward-to-oauth2 req)))

If it was only a case of a magic user being able to access a subset of the system then I can see how to do that, but to allow them to access the entirety of the existing system...?

Help :-)

commented

I'm not sure I understand the problem. I don't understand what's stopping you from just not using the oauth2 middleware in the case of that particular user.

commented

I think I assumed that this lib also forces authentication for the URLs so I couldn't see how to teach it to understand non-OAuth2 authentication. My bad :-). Closing.