From eff858eb74faa4d21d1bdf1b46f8af13024f46dc Mon Sep 17 00:00:00 2001
From: demx8as6 <martin.skorupski@highstreet-technologies.com>
Date: Sat, 17 Sep 2022 10:17:00 +0200
Subject: [PATCH] update controller service

- update of oauth settings which are no more restrictive and
better aligned with with the identity service.

IssueID OAM-297
Change-Id: I3f652320a4774e1fe4649bf946b91feac8652260
Signed-off-by: demx8as6 <martin.skorupski@highstreet-technologies.com>
---
 .../integration/smo/oam/sdnr/oauth-aaa-app-config.xml     | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/solution/integration/smo/oam/sdnr/oauth-aaa-app-config.xml b/solution/integration/smo/oam/sdnr/oauth-aaa-app-config.xml
index 15bc953..c210e37 100644
--- a/solution/integration/smo/oam/sdnr/oauth-aaa-app-config.xml
+++ b/solution/integration/smo/oam/sdnr/oauth-aaa-app-config.xml
@@ -72,26 +72,35 @@
         <pair-key>/**/v1/**</pair-key>
         <pair-value>authcBearer, roles[admin]</pair-value>
     </urls>
+    <!-- allow admin only access to write mdsal auth config -->
     <urls>
-        <pair-key>/**/config/aaa*/**</pair-key>
+        <pair-key>/rests/**/aaa*/**</pair-key>
         <pair-value>authcBearer, roles[admin]</pair-value>
     </urls>
-     <urls>
+    <!-- anon access for login api -->
+    <urls>
         <pair-key>/oauth/**</pair-key>
         <pair-value>anon</pair-value>
     </urls>
+    <urls>
+        <pair-key>/ready</pair-key>
+        <pair-value>anon</pair-value>
+    </urls>
+    <!-- anon access for odlux ui -->
     <urls>
         <pair-key>/odlux/**</pair-key>
         <pair-value>anon</pair-value>
     </urls>
+    <!-- admin only access for apidocs -->
     <urls>
         <pair-key>/apidoc/**</pair-key>
-        <pair-value>authcBasic</pair-value>
+        <pair-value>authcBasic, roles[admin]</pair-value>
     </urls>
     <urls>
         <pair-key>/rests/**</pair-key>
         <pair-value>authcBearer, anyroles["admin,provision"]</pair-value>
     </urls>
+    <!-- any other access with configured dynamic filter -->
     <urls>
         <pair-key>/**</pair-key>
         <pair-value>authcBearer, anyroles["admin,provision"]</pair-value>
-- 
2.16.6