Interaction between Super Admin, Projects, and Cli...
# supportc
codingtom
10/12/2023, 8:30 PMI'm looking to use client-assigned IDs, which according to the linked issue should be possible on self-hosted instances, using Super Admin credentials: https://github.com/medplum/medplum/pull/2263
codingtom
10/12/2023, 8:31 PMMy goal is to configure a regular project, with a ClientApplication that has the required super admin permissions for that project. But I'm not super clear on how to configure the client in a non-super-admin project, while still giving it the right permissions. Is this possible, or would I want the data project to be a Super Admin project as well?
codingtom
10/12/2023, 8:32 PMI tried exploring:
- Create a new Client for the main Super Admin project, with Admin flag set.
- Create a new Project.
- Manually add a ProjectMembership linking the two.
However, this didn't seem to have the effect I wanted... I suspect I need to have a few more things set up in the target project (e.g. a Practitioner? Or maybe to create the actual ClientApplication in the target project).
codingtom
10/12/2023, 8:34 PMI realize this is not a well-supported usecase, but hoping to at least try it out 😅
codingtom
10/12/2023, 8:54 PMI unblocked myself locally by just using a Client against the Super Admin project, but perhaps it is not best practice to be dropping data into that project in production?
r
rahul1
10/12/2023, 10:09 PMHi @codingtom - In general, we recommend using Super Admin in this way, as Super Admin operations bypass most of our validation and support logic, making it very easy to create resources in a broken state.
However, if you're feeling confident, then you are on the right path. The catch is that you have to create a ClientApplication is in the SuperAdmin project, and then keep it in that project.
The SuperAdmin project is a special project, that gives a global view of all the resources in the server. Any user with a membership to the SuperAdmin project has SuperAdmin priveledges.
You can't give superAdmin priveledge to resources that are not part of that project
c
codingtom
10/12/2023, 10:15 PMOK thanks for the clarification! 🙂
codingtom
10/12/2023, 10:17 PM> Super Admin operations bypass most of our validation and support logic, making it very easy to create resources in a broken state
Curious to hear more about the specifics here; this means that no object validation is done on writes whatsoever? What kind of downstream effects could this have?
codingtom
10/12/2023, 10:19 PMI think unfortunately it's a risk we might have to take; the ability to upsert resources idempotently (without resorting to a fetch+insert+update or
ifNoneExistr
rahul1
10/12/2023, 10:46 PMI'd have to double check on object validation, but yes I believe that's teh case. Also, access policies will not be enforeced
rahul1
10/12/2023, 10:47 PMI appreciate the frustration, but yes we are making progress. This PR (https://github.com/medplum/medplum/pull/2273) is the first step in allowing a Client Assigned IDs in a way that respects our multi-tenant project model
c
codingtom
10/12/2023, 11:14 PMNo worries, thankyou!
161 Views