Mercurial > hg > orthanc-authorization
annotate Plugin/DefaultConfiguration.json @ 149:423531fb1200
SINGLE_RESOURCE_PATTERNS to facilitate api-key support
| author | Alain Mazy <am@osimis.io> |
|---|---|
| date | Thu, 15 Feb 2024 16:30:21 +0100 |
| parents | 20c638fa8b07 |
| children | 9f686ee4b158 |
| rev | line source |
|---|---|
| 71 | 1 { |
| 2 "Authorization" : { | |
|
72
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
3 // The Base URL of the auth webservice. This is an alias for all 3 next configurations: |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
4 // // "WebServiceUserProfileUrl" : " ROOT /user/get-profile", |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
5 // // "WebServiceTokenValidationUrl" : " ROOT /tokens/validate", |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
6 // // "WebServiceTokenCreationBaseUrl" : " ROOT /tokens/", |
| 79 | 7 // // "WebServiceTokenDecoderUrl" : " ROOT /tokens/decode", |
|
73
512247750f0a
new ValidityDuration arg in create token API
Alain Mazy <am@osimis.io>
parents:
72
diff
changeset
|
8 // You should define it only if your auth webservice implements all 3 routes ! |
|
72
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
9 // "WebServiceRootUrl" : "http://change-me:8000/", |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
10 |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
11 // The URL of the auth webservice route implementing user profile (optional) |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
12 // (this configuration was previously named "WebService" and its old name is still accepted |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
13 // for backward compatibility) |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
14 // "WebServiceUserProfileUrl" : "http://change-me:8000/user/profile", |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
15 |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
16 // The URL of the auth webservice route implementing resource level authorization (optional) |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
17 // "WebServiceTokenValidationUrl" : "http://change-me:8000/tokens/validate", |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
18 |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
19 // The Base URL of the auth webservice route to create tokens (optional) |
|
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
20 // "WebServiceTokenCreationBaseUrl" : "http://change-me:8000/tokens/", |
| 71 | 21 |
| 79 | 22 // The URL of the auth webservice route implementing token decoding (optional) |
| 23 // "WebServiceTokenDecoderUrl": "http://change-me:8000/tokens/decode" | |
| 24 | |
| 71 | 25 // The username and password to connect to the webservice (optional) |
| 26 //"WebServiceUsername": "change-me", | |
| 27 //"WebServicePassword": "change-me", | |
| 28 | |
| 29 // An identifier added to the payload of each request to the auth webservice (optional) | |
| 30 //"WebServiceIdentifier": "change-me" | |
| 31 | |
| 32 // The name of the HTTP headers that may contain auth tokens | |
| 33 //"TokenHttpHeaders" : [], | |
| 34 | |
| 83 | 35 // The name of the GET arguments that may contain auth tokens |
| 71 | 36 //"TokenGetArguments" : [], |
| 37 | |
| 38 // A list of predefined configurations for well-known plugins | |
| 39 // "StandardConfigurations": [ // new in v 0.4.0 | |
| 40 // "osimis-web-viewer", | |
| 41 // "stone-webviewer", | |
| 42 // "orthanc-explorer-2" | |
| 43 // ], | |
| 44 | |
| 45 //"UncheckedResources" : [], | |
| 46 //"UncheckedFolders" : [], | |
| 47 //"CheckedLevel" : "studies", | |
| 48 //"UncheckedLevels" : [], | |
| 49 | |
| 50 // Definition of required "user-permissions". This can be fully customized. | |
|
72
e381ba725669
new PUT auth/tokens/{token-type} API route + updated interface with WebService
Alain Mazy <am@osimis.io>
parents:
71
diff
changeset
|
51 // You may define other permissions yourself as long as they match the permissions |
| 71 | 52 // provided in the user-profile route implemented by the auth-service. |
| 53 // You may test your regex in https://regex101.com/ by selecting .NET (C#) and removing the leading ^ and trailing $ | |
|
95
dff72e397f90
fix standard configuration 'orthanc-explorer-2' for TokenGetArguments
Alain Mazy <am@osimis.io>
parents:
91
diff
changeset
|
54 // The default configuration is suitable for Orthanc-Explorer-2 (see https://github.com/orthanc-team/orthanc-auth-service) |
| 71 | 55 "Permissions" : [ |
| 75 | 56 ["post", "^/auth/tokens/decode$", ""], |
|
77
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
57 ["post", "^/tools/lookup$", ""], // currently used to authorize downloads in Stone (to map the StudyInstanceUID into an OrthancID. Not ideal -> we should define a new API that has the resource ID in the path to be able to check it at resource level) but, on another hand, you do not get any Patient information from this route |
| 75 | 58 |
| 71 | 59 // elemental browsing in OE2 |
| 60 ["post", "^/tools/find$", "all|view"], | |
|
115
0eed78c1e177
cache the UserProfile + updated http filter logic
Alain Mazy <am@osimis.io>
parents:
100
diff
changeset
|
61 ["get" , "^/(patients|studies|series|instances)(|/)", "all|view"], |
| 71 | 62 ["get" , "^/statistics$", "all|view"], |
|
90
bb4c32b25c5d
Added a default permission for /changes
Alain Mazy <am@osimis.io>
parents:
89
diff
changeset
|
63 ["get" , "^/changes$", "all|view"], |
| 71 | 64 |
|
149
423531fb1200
SINGLE_RESOURCE_PATTERNS to facilitate api-key support
Alain Mazy <am@osimis.io>
parents:
148
diff
changeset
|
65 // single resources patterns (SINGLE_RESOURCE_PATTERNS is an alias for all single resource patterns defined in https://orthanc.uclouvain.be/hg/orthanc-authorization/file/tip/Plugin/DefaultAuthorizationParser.cpp) |
|
423531fb1200
SINGLE_RESOURCE_PATTERNS to facilitate api-key support
Alain Mazy <am@osimis.io>
parents:
148
diff
changeset
|
66 // (a user must have access to the route + have an authorized label to access the resource) |
|
423531fb1200
SINGLE_RESOURCE_PATTERNS to facilitate api-key support
Alain Mazy <am@osimis.io>
parents:
148
diff
changeset
|
67 ["get" , "SINGLE_RESOURCE_PATTERNS", "all|view"], |
|
423531fb1200
SINGLE_RESOURCE_PATTERNS to facilitate api-key support
Alain Mazy <am@osimis.io>
parents:
148
diff
changeset
|
68 |
| 75 | 69 // create links to open viewer or download resources |
| 70 ["put", "^/auth/tokens/(viewer-instant-link|meddream-instant-link)$", "all|view"], | |
| 71 ["put", "^/auth/tokens/(download-instant-link)$", "all|download"], | |
| 72 | |
| 73 // share a link to open a study | |
|
91
50b18e7a254d
Added a default permission for /auth/tokens/ohif-viewer-publication
Alain Mazy <am@osimis.io>
parents:
90
diff
changeset
|
74 ["put", "^/auth/tokens/(stone-viewer-publication|meddream-viewer-publication|osimis-viewer-publication|ohif-viewer-publication)$", "all|share"], |
| 75 | 75 |
| 76 // uploads | |
| 77 ["post", "^/instances$", "all|upload"], | |
|
146
f294a3c6dbe6
Added 2 new default permissions for dicom-web (get and post on dicom-web/studies)
Alain Mazy <am@osimis.io>
parents:
127
diff
changeset
|
78 ["post" , "^/DICOM_WEB_ROOT/studies$", "all|upload"], |
| 75 | 79 |
| 71 | 80 // monitor jobs you have created |
| 81 ["get" , "^/jobs/([a-f0-9-]+)$", "all|send|modify|anonymize|q-r-remote-modalities"], | |
| 82 | |
| 83 // interacting with peers/modalities/dicomweb | |
| 84 ["post", "^/(peers|modalities)/(.*)/store$", "all|send"], | |
| 85 ["get" , "^/(peers|modalities)$", "all|send|q-r-remote-modalities"], | |
| 86 ["post", "^/modalities/(.*)/echo$", "all|send|q-r-remote-modalities"], | |
| 87 ["post", "^/modalities/(.*)/query$", "all|q-r-remote-modalities"], | |
| 88 ["get", "^/queries/([a-f0-9-]+)/answers$", "all|q-r-remote-modalities"], | |
| 89 ["post", "^/modalities/(.*)/move$", "all|q-r-remote-modalities"], | |
| 75 | 90 ["get" , "^/DICOM_WEB_ROOT/servers$", "all|send|q-r-remote-modalities"], |
| 71 | 91 ["get" , "^/DICOM_WEB_ROOT/(servers)/(.*)/stow$", "all|send"], |
|
148
20c638fa8b07
new permissions for QIDO-RS & WADO-RS
Alain Mazy <am@osimis.io>
parents:
146
diff
changeset
|
92 |
|
20c638fa8b07
new permissions for QIDO-RS & WADO-RS
Alain Mazy <am@osimis.io>
parents:
146
diff
changeset
|
93 // DICOMWeb QIDO-RS |
|
20c638fa8b07
new permissions for QIDO-RS & WADO-RS
Alain Mazy <am@osimis.io>
parents:
146
diff
changeset
|
94 ["get" , "^/DICOM_WEB_ROOT/(studies|series|instances)(|/)$", "all|view"], |
|
20c638fa8b07
new permissions for QIDO-RS & WADO-RS
Alain Mazy <am@osimis.io>
parents:
146
diff
changeset
|
95 |
| 71 | 96 // modifications/anonymization |
|
127
8591a0c1fa2a
updated default 'Permissions' configuration to take the '/merge' routes into account
Alain Mazy <am@osimis.io>
parents:
115
diff
changeset
|
97 ["post", "^/(patients|studies|series|instances)/([a-f0-9-]+)/(modify|merge)(.*)$", "all|modify"], |
|
77
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
98 ["post", "^/(patients|studies|series|instances)/([a-f0-9-]+)/anonymize(.*)$", "all|anonymize"], |
|
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
99 |
|
100
760fd9ad7007
new default permissions for labels
Alain Mazy <am@osimis.io>
parents:
95
diff
changeset
|
100 // labels |
|
760fd9ad7007
new default permissions for labels
Alain Mazy <am@osimis.io>
parents:
95
diff
changeset
|
101 ["get", "^/tools/labels$", "all|view|edit-labels"], |
|
760fd9ad7007
new default permissions for labels
Alain Mazy <am@osimis.io>
parents:
95
diff
changeset
|
102 ["put" , "^/(patients|studies|series|instances)/([a-f0-9-]+)/labels/(.*)$", "all|edit-labels"], |
|
760fd9ad7007
new default permissions for labels
Alain Mazy <am@osimis.io>
parents:
95
diff
changeset
|
103 ["delete" , "^/(patients|studies|series|instances)/([a-f0-9-]+)/labels/(.*)$", "all|edit-labels"], |
|
760fd9ad7007
new default permissions for labels
Alain Mazy <am@osimis.io>
parents:
95
diff
changeset
|
104 |
|
77
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
105 // deletes |
|
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
106 ["delete" , "^/(patients|studies|series|instances)/([a-f0-9-]+)$", "all|delete"], |
| 89 | 107 ["post" , "^/tools/bulk-delete$", "all|delete"], |
|
77
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
108 |
|
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
109 // settings |
|
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
110 ["put", "^/tools/log-level$", "all|settings"], |
|
94a9484d7f8f
fix security issues allowing to browse remote dicom servers + introduced UnitTests
Alain Mazy <am@osimis.io>
parents:
75
diff
changeset
|
111 ["get", "^/tools/log-level$", "all|settings"] |
| 71 | 112 ] |
| 113 } | |
| 114 } |