KRYSTALM7 opened a new issue, #52:
URL: https://github.com/apache/fineract-loan-origination/issues/52
### Summary
Replaces the initial placeholder authentication approach: customer
authentication is fully owned and validated by LOS, while staff/backoffice
authentication temporarily delegates credential validation and permission
resolution to Fineract. These are two independent auth models serving two
different user populations, not variations of a single flow.
### Customer authentication (LOS-owned)
POST /api/v1/auth/login accepts { username, password, tenantId }.
Credentials are verified locally against the customer_credentials table
using BCrypt — no call to Fineract at any point in this flow.
On success, LOS resolves the customer's fineractClientId (used purely for
data-scoping, not authentication).
LOS issues a 15-minute JWT containing clientId, tenantId, correlationId.
JwtAuthFilter authorizes all subsequent /api/v1/customer/** requests.
### Staff authentication (Fineract-delegated, explicitly temporary)
The backoffice UI authenticates staff directly against Fineract (LOS is not
involved in this step).
The resulting Fineract-issued Basic Auth token is forwarded by the
backoffice UI on every request to LOS.
LOS validates that token is still valid against Fineract, then calls GET
/v1/permissions with the same credential to resolve the staff user's actual
permission set.
Permission codes returned by Fineract are mapped to Spring
GrantedAuthoritys, replacing the previous InMemoryUserDetailsManager-based
hardcoded roles.
Rationale: staff are already authenticated Fineract users; reusing that
avoids duplicating a second identity system for internal users.
### Acceptance criteria
Customer login/JWT flow has zero outbound calls to Fineract.
InMemoryUserDetailsManager and its hardcoded staff users are fully removed.
### Note
Existing local dev environments authenticating as staff via the old
in-memory users will stop working once this merges, staff logins must go
through the backoffice UI's Fineract auth flow going forward.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
