Problem Statement 1
Current problem with Sunbird is any one can create a root-organisation, sub-organisation, user, add user to an existing organisation etc. Further, there is a cyclic problem at system installation time with regard to user and organisation creation. Creation of user requires organisation and creation of organisation requires user. Presently, this cycle dependency is avoided by creating organisation using Keycloak (SSO) admin user token.
Proposed Solution
After successful installation, use an 'initialisation' script to create a system admin (first) user inside Sunbird and Keycloak.
System Admin User Creation
Once system admin user is created, the system admin user can perform following actions:
...
Alternative 1: Storing system admin user details in existing Keycloak realm.
| Pros | Cons |
|---|---|
|
|
Alternative 2: Storing system admin user details in new Keycloak realm.
| Pros | Cons |
|---|---|
|
|
System Admin APIs
1. Create System Admin User
...
Existing User Create and Assign Roles APIs need to be modified to allow creation of an organisation admin user by a system admin or another organisation admin user only.
System Initialisation Script
Sunbird will provide a system initialisation script to simplify the Sunbird setup process for adopters.
...
- Create first system admin user
- Create first root organisation
- Create first root organisation admin user
Problem statement 2
During user creation, user is added to a root organisation identified by channel property. This channel value can come in Create User API request or can be inferred based on environment variable for default channel (i.e. sunbird_default_channel). The problem with this approach is one more environment variable needs to be set by any Sunbird adopter and particularly an unnecessary setting for an adopter planning to have only one root organisation. In case of a Sunbird adopter with multiple root organisations and environment configuration for Sunbird default channel with a different root organisation, user creations without channel can result in users being silently added to an unintended root organisation which is not desirable.
Proposed Solution
Remove the environment variable sunbird_default_channel. Every time channel will either come from request or system can take it from database based on below logic:
...