creating a superuser admin in loopback

Question

Am still digging deep into loopback kindly help out. I have the following models: admin=> extends the built-in User model, student=> extend from the built in User model and other models ofcoz.

Brief:

I do not want an authenticated instance student to be able to to access the endpoint Student GET /students. I do not want Student to be able to have access to information about all of the Student(s). So, I've proposed admin, which should be able to access the endpoint GET /students through the implementation of a Role. I want the admin to be able to access all endpoints

Standing:

In script.js

module.exports = function(app) {
 const User = app.models.admin;
 const Role = app.models.Role;
 const RoleMapping = app.models.RoleMapping;


 Role.find({ name: 'admin' }, function(err, results) {
    if (err) { 
        throw err;
     }

    if (results.length < 1) {

        // now  Role creation...
   User.create([{name:'Felix Olonde',username:"felix",email: '[email protected]', password: 'felix123',phone_number:3127287656,dob:1988-03-04,state: 'LA'
    }
  ], function(err, users) {
    if (err) throw err;

    console.log('Created user:', users);

    //create the admin role
    Role.create({
      name: 'admin'
    }, function(err, role) {
      if (err) throw err;

      console.log('Created role:', role);

      role.principals.create({
        principalType: RoleMapping.USER,
        principalId: users[0].id
      }, function(err, principal) {
        if (err) throw err;

        console.log('Created principal:', principal);
      });
    });
  });

    }
});

}

student.json

"acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",//student to access their own information
      "permission": "ALLOW"
    },
    {
      "accessType": "EXECUTE",
      "principalType": "ROLE",
      "principalId": "admin",
      "permission": "ALLOW",
      "property": "find"
    }
  ],

admin.json

  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW"
    }
  ],

Problem

After logging in the admin which is successfully created in the database( I use mongo hosted in mLab), when i try to get all students using the explorer i keep getting 401.."Authorization Required"

Aim

I only want admin to be able to really have complete control over the API endpoints. I.e. admin should be able to get all students etc.

Antonio Trapani Antonio Trapani · Accepted Answer · 2019-03-06T09:28:46

In most cases, a good design is having a single class Member (or Customer or whatever you like) extending the built-in User model.

Basically, you register two members, create the role admin and promote admin one of the two members. An example here: Multiple users roles loopback

The acls in student.json is correct and will work.

If you really want to have different models extending the built-in User, access control with multiple user models is well explained in the official documentation:

https://loopback.io/doc/en/lb3/Authentication-authorization-and-permissions.html#access-control-with-multiple-user-models

creating a superuser admin in loopback

1 Answers