{"action":"created","issue":{"url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client/issues/89","repository_url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client","labels_url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client/issues/89/labels{/name}","comments_url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client/issues/89/comments","events_url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client/issues/89/events","html_url":"https://github.com/damienbod/angular-auth-oidc-client/issues/89","id":263863044,"number":89,"title":"Using Route Guards and Auto Login","user":{"login":"thecepe","id":32518794,"avatar_url":"https://avatars1.githubusercontent.com/u/32518794?v=4","gravatar_id":"","url":"https://api.github.com/users/thecepe","html_url":"https://github.com/thecepe","followers_url":"https://api.github.com/users/thecepe/followers","following_url":"https://api.github.com/users/thecepe/following{/other_user}","gists_url":"https://api.github.com/users/thecepe/gists{/gist_id}","starred_url":"https://api.github.com/users/thecepe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thecepe/subscriptions","organizations_url":"https://api.github.com/users/thecepe/orgs","repos_url":"https://api.github.com/users/thecepe/repos","events_url":"https://api.github.com/users/thecepe/events{/privacy}","received_events_url":"https://api.github.com/users/thecepe/received_events","type":"User","site_admin":false},"labels":[{"id":685696609,"url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client/labels/enhancement%20documentation","name":"enhancement documentation","color":"006b75","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-10-09T11:30:20Z","updated_at":"2017-10-28T06:45:19Z","closed_at":null,"author_association":"NONE","body":"Hi Damien,\r\n\r\nthanks for your great library and all your work you put into it! \r\n\r\nI'm trying to protect all routes via a route guard. The route guard should first check if the user is logged in and then if the user has the required role to access this path. This was my first approach:\r\n\r\n```\r\n  canActivate(next: ActivatedRouteSnapshot, state: RouterStateSnapshot): Observable<boolean> | Promise<boolean> | boolean {\r\n    const expectedRoles = next.data['expectedRoles'] as Array<string>;\r\n    if (this.isAuthorized) { // subscription to this.oidcSecurityService.getIsAuthorized()\r\n      // check if user has required roles in access token\r\n      if (this.hasRequiredRoles(expectedRoles)) {\r\n        // user can access path\r\n        return true;\r\n      } else {\r\n        // user doesn't have required role\r\n        this.router.navigate(['/forbidden']);\r\n        return false;\r\n      }\r\n    } else {\r\n      // trigger login\r\n      this.oidcSecurityService.authorize();\r\n      return false;\r\n    }\r\n  }\r\n```\r\n\r\nAt first I had similar issues like Brent described in #82. I ended up in a loop, because after the redirect from the IDP - when the user was successfully authenticated - the subscription to _oidcSecurityService.getIsAuthorized()_ is processed after the guard performs the check so that _this.isAuthorized_ is never true.\r\n\r\nI followed your example (https://github.com/damienbod/angular-auth-oidc-sample-google-openid/blob/master/src/AngularClient/angularApp/app/app.component.ts) to resolve the problem. \r\n\r\nSo I split the check: I moved login/authentication to app.component.ts, created the auto-login component and left only the role check in the guard. \r\nIf I disable the guard everything works like expected: If the user is not logged in, he is redirected to the IDP and _after_ the login to the page originally requested page.\r\n\r\nWhen enabling the guard, it is processed before the logic in _app.component.ts_ so that for an unauthenticated user the role check always fails and _canActivate()_ returns false. This always changes the path to 'forbidden', if I remove the _router.navigate(..)_ the path seems to be reset.\r\n\r\nSo I still need a way to reliably check in the guard if the user is authenticated, so that the role check can be disabled if he is not. \r\nBut the best solution would be to perform all authentication and role checks in one place. Preferably the guard, so that required roles for a path can be defined in _app.routes.ts_.\r\n\r\nAny help is appreciated. \r\n\r\nBest regards\r\n\r\nChristian\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client/issues/comments/340148341","html_url":"https://github.com/damienbod/angular-auth-oidc-client/issues/89#issuecomment-340148341","issue_url":"https://api.github.com/repos/damienbod/angular-auth-oidc-client/issues/89","id":340148341,"user":{"login":"robisim74","id":14012361,"avatar_url":"https://avatars3.githubusercontent.com/u/14012361?v=4","gravatar_id":"","url":"https://api.github.com/users/robisim74","html_url":"https://github.com/robisim74","followers_url":"https://api.github.com/users/robisim74/followers","following_url":"https://api.github.com/users/robisim74/following{/other_user}","gists_url":"https://api.github.com/users/robisim74/gists{/gist_id}","starred_url":"https://api.github.com/users/robisim74/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robisim74/subscriptions","organizations_url":"https://api.github.com/users/robisim74/orgs","repos_url":"https://api.github.com/users/robisim74/repos","events_url":"https://api.github.com/users/robisim74/events{/privacy}","received_events_url":"https://api.github.com/users/robisim74/received_events","type":"User","site_admin":false},"created_at":"2017-10-28T06:45:19Z","updated_at":"2017-10-28T06:45:19Z","author_association":"COLLABORATOR","body":"@nathanvv you should not put the setup in your authGuard. You should store the current route and redirect automatically the user after login activating _trigger_authorization_result_event_ and using _onAuthorizationResult_ in your _app.component_. See also here: #104"}}
{"actor":{"display_login":"robisim74"}}