How would I configure a single-user "demo" instance without admin powers?

[jnothman]

I want to be able to run a demo of Leaf with a non-admin user, without setting up an identity service provider. This allows us to demo the Leaf functionality without exposing the entire database. What would be the easiest way to do this?

(My first attempt, dropping the "admin" claim from the Claims field of the admin user in auth.Login didn't work.)

[jnothman]

Found it!

leaf/src/server/API/Authorization/UnsecureEntitlementProvider.cs

Line 24 in 35705a4

Mask = RoleMask.User | RoleMask.Admin | RoleMask.Super | RoleMask.Identified | RoleMask.Federated,

[ndobb]

Yes, that's where I would start as well, @jnothman. If you run into other issues with this please let us know.

[jnothman]

We've currently managed to hack this to give a basic user on the basis of an environment variable: ElevnLi@247cf00
Ideally we'd control this from appsettings.json.

[ndobb]

Nice work @ElevnLi and @jnothman! We'd love to work these changes in upstream.

How about adding in something like:

"Authorization": {
    "Mechanism": "UNSECURED",
    "AllowAllAuthenticatedUsers": true,
    "UnsecuredIsAdmin": false,
    ...

[jnothman]

Happy for that config, we just needed a quick fix for a demo. :)

[ndobb]

@jnothman I'll work that into our next minor release, seems very straightforward.