IdStory Identity Manager

After a long effort I have discarded the idea of integrating Spring OAuth as IdM authentication server.
There are multiple reasons, but mainly I seem to be unable to configure other auth. filters (such as basic auth) to work with the framework right.

So currently I'm using the original IdM JWT token as authentication mechanism and only use the Spring Oauth as a library.
I have implemented and manually tested (cURL) Basic authentication (token independent)
and authenticating against remote trusted authority. The remote authority was set up as locally running OAuth2 server, which issues JWT tokens to user called "user".
The authentication is then done by redirecting the user to IdM login endpoint and issuing our custom JWT token.

I started work on "just in time authority management" - a possibility to revoke access to the API for users, who have some changes in the authorities since their
authentication token was issued. I got familiar with event processors and Iam currently enhancing the token by additional attributes (defined by specification) and testing.

There is only the token refreshing left from the original assignment. I have some questions here, which I'll prepare and send, hopefully by tomorrow.

I have implemented and tested the just in time authorities management. Each token now has an issue date, which always has to be after last authorities modification date (IdmIdentity field). Last auth. modification is set when a role is added (TODO) or deleted, it should also work with role expiration (future work). Role events are intercepted by IdmIdentityRole processor with lowest order, so that all CRUD operations are run first.
I've also replace all java.util.Date occurences in JWT / authentication with Joda's DateTime.

Then I've encountered heavy problems when managing redirects while authenticating with remote auth. token in FE. It seems that isomorphic-fetch has some issues with redirects under CORS policies, which I haven't resolved yet. CORS block message:

Redirect from ... to ... has been blocked by CORS policy: Request requires preflight, which is disallowed to follow cross-origin redirect.

The main problem seems to be the "Location" header, which causes the browser redirect. Without it the fetch at least accepts status 302.
I still cannot set any response headers, though. (???)
As I still cannot overcome the redirect both with and without CORS (or the redirect alone), the next idea is to send the redirect URL in the response body as an error and then parse it out. Unfortunately it seems even the status has to be an error, otherwise all ".then" callbacks are still called and currently there is no way to stop a "then" callback chain from executing in isomorphic-fetch...

Redirects did not work, so I have implemented the SSO-like login using some kind of "pre request", as Radek suggested.
I have successfully tested the idea. Now if the user has a valid bearer token in the "Authorization" HTTP header, FE automatically logs them in.

If the IdM login expires but the original remote auth token bearer is still present in the HTTP request and valid, the user is automatically re-logged in. If the remote token is not valid, the user is redirected to /login page - that is the original behavior.
I'm not sure what is the preferred behavior for logout, though. Currently I've left it out, so if the user has a valid remote token a clicks on "Logout", he is immediately logged in again -> no logout for SSO.

I have also tested the JIT authority management - remove any user role that carries some authorities enforces token "expiration".

I've started with rebase on develop and resolving conflicts. The change of internal authorization model definitely made conflict resolution a challenging task.
There are still 2 test errors and 8 failures, but hopefully I'll have this done by tomorrow.

Tests fixed, code merged, conflicts resolved, tests fixed again, code committed and pushed to develop.
Doc update is remains the last thing to do.

[WARN] Remote login error occurred: { id: '082c5b48-a737-4881-872a-df5a28010568',
  creation: '2017-05-03T13:23:23.019Z',
  statusEnum: 'FORBIDDEN',
  message: 'Forbidden.',
  parameters: 
   { path: '/idm-app/api/v1/authentication/remote-auth',
     message: 'Access Denied' },
  module: 'core',
  statusCode: 403,
  status: 'FORBIDDEN' }

Security manager FE class hides all flash messages during login or logout. The problem is, messages are hidden even when accessing the login page.

I've added EN docu to: https://proj.bcvsolutions.eu/ngidm/doku.php?id=en:navrh:authentication
CS version is outdated!