soajs.controller 4.3.16 → 4.3.18

package/ARCHITECTURE.md

@@ -156,6 +156,7 @@ The gateway processes requests through a sequential middleware pipeline:
 | [External Integrations](docs/external-integrations.md) | OAuth, URAC, and infrastructure integrations |
 | [Deployment Architecture](docs/deployment.md) | High availability deployment patterns |
 | [Custom Registry Configuration](docs/configuration-custom-registry.md) | Environment-specific gateway settings |
+| [Tenant Access Resolver Guide](docs/tenant-access-resolver.md) | Step by step: give a group of users access to a tenant through an API of your app |
 | [Services Config](docs/configuration-services-config.md) | Tenant key-specific configuration |
 | [Gateway Routes](docs/gateway-routes.md) | Built-in gateway routes (/soajs/acl, /soajs/proxy) |
 | [Maintenance Routes](docs/maintenance-routes.md) | Health check and admin endpoints |

package/docs/configuration-custom-registry.md

@@ -4,7 +4,7 @@ Environment-specific gateway settings stored in the Core DB custom registry.
 
 ## Configuration Structure Overview
 
-These settings are accessed via `registry.custom.gateway.value.*` and `registry.custom.oauth.value.*`.
+These settings are accessed via `registry.custom.gateway.value.*`, `registry.custom.oauth.value.*` and `registry.custom.urac.value.*`.
 
 ```
 registry.custom
@@ -35,11 +35,15 @@ registry.custom
 │       └── gotoService
 │           ├── monitor             # Request monitoring config
 │           └── renewReqMonitorOff  # Disable timeout renewal
-└── oauth
+├── oauth
+│   └── value
+│       ├── roaming                 # Cross-environment access
+│       ├── pinWrapper              # PIN-based login endpoint
+│       └── pinWhitelist            # PIN login API whitelist
+└── urac
     └── value
-        ├── roaming                 # Cross-environment access
-        ├── pinWrapper              # PIN-based login endpoint
-        └── pinWhitelist            # PIN login API whitelist
+        └── tenantAccessResolvers   # APIs that grant access to a tenant
+            └── [resolver]          # One API per resolver name
 ```
 
 ---
@@ -577,6 +581,185 @@ loaded from urac per request and the membership is current.
 
 ---
 
+## 15. Tenant Access Resolver
+
+**Path:** `registry.custom.urac.value.tenantAccessResolvers`
+
+**Middleware:** `mw/mt/urac.js`, called by `mw/mt/tenantAccess.js`
+
+Gives a group of users access to a tenant without inviting each of them, for example
+every user of a department of an app. The tenant names a resolver, and the resolver is
+an API of that app that answers, per user, whether they have access and with what
+groups. Nothing is written on the users, `allowedTenants` stays untouched.
+
+Users always log in at their home tenant and then switch, by calling the gateway with
+their token and the key of the other tenant. The resolver is asked on those calls.
+
+Setting it up takes three steps:
+
+1. Build the API in a service of the app, see [The API to build](#the-api-to-build)
+2. Add the resolver to the `urac` custom registry, see [The resolver](#the-resolver)
+3. Name the resolver in the profile of each tenant, see [The tenant](#the-tenant)
+
+### The API to build
+
+Any route of a service in the registry. The gateway calls it directly, not through the
+gateway, so it does not need to be granted in any package. Keep it out of every ACL,
+its answer is trusted as is.
+
+It receives:
+
+```javascript
+// Body
+{
+  "user": {
+    "id": "5c8d0c505653de3985aa1001",
+    "username": "ann",
+    "tenant": { "id": "...", "code": "HOME" }   // Home tenant of the user
+  },
+  "tenant": {
+    "id": "...",
+    "code": "DEPT",
+    "main": { "id": "...", "code": "MAIN" }     // Only for a sub tenant
+  },
+  "subject": "dept_1"                           // From the tenant profile
+}
+```
+
+The `soajsinjectobj` header carries the tenant, the key with `commonFields` and the
+config of the resolver service, and the application of the request, so a service with
+`extKeyRequired` accepts the call. It carries no user and no ACL.
+
+It answers with a standard SOAJS response:
+
+```javascript
+// Access
+{
+  "result": true,
+  "data": {
+    "access": true,
+    "groups": ["member"],
+    "groupsConfig": {
+      "allowedPackages": { "PROD": ["PROD_USER"] }
+    }
+  }
+}
+
+// No access
+{ "result": true, "data": { "access": false } }
+```
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| `access` | yes | `true` to grant access |
+| `groupsConfig.allowedPackages` | yes, with access | Packages per product, the shape urac builds from the user's groups |
+| `groups` | no | Group codes services see on the urac object, `[]` when absent |
+
+The answer is the ACL. Nothing caps it, a package the API returns is granted. Only the
+entry of the product of the key is used.
+
+It runs on every call under the tenant, keep it fast.
+
+### The resolver
+
+```javascript
+{
+  "name": "urac",
+  "value": {
+    "tenantAccessResolvers": {
+      "department": {
+        "service": "departments",
+        "version": "1",
+        "method": "post",
+        "api": "/tenant/access",
+        "timeout": 2000
+      }
+    }
+  }
+}
+```
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `service` | string | - | Service that answers, must be in the registry |
+| `version` | string | latest | Version of the service |
+| `method` | string | `post` | HTTP method |
+| `api` | string | - | Route on the service, without the service name |
+| `timeout` | number | `2000` | Milliseconds before the call counts as no access |
+
+The tenant names the resolver and the registry defines the call, so the API can move
+without touching any tenant. A tenant naming a resolver that is not defined here is
+logged as an error and treated as having none.
+
+### The tenant
+
+The tenant profile names the resolver and the subject the API should check, here the
+department:
+
+```javascript
+{
+  "profile": {
+    "access": {
+      "resolver": "department",   // A key of tenantAccessResolvers
+      "subject": "dept_1"         // Passed to the API as is
+    }
+  }
+}
+```
+
+The profile is loaded with the key, so a change applies once the key cache refreshes.
+`PUT /tenant/profile` of multitenant replaces the whole profile, whatever edits it must
+keep `access`.
+
+### When it is asked
+
+For every call made with a token under a tenant that is not the user's home tenant, in
+this order:
+
+| Order | Condition | Result |
+|-------|-----------|--------|
+| 1 | The token's `config.allowedTenants` lists the tenant | Invited, urac driver as before, the resolver is not asked |
+| 2 | The tenant profile names a resolver | The resolver is asked |
+| 3 | The resolver says no, fails or times out, or there is no resolver | urac driver as before |
+
+It is never asked for the user's home tenant, for a token issued for this tenant, for
+roaming, or for `loginMode: "oauth"` tokens.
+
+On access the gateway takes the user from the token, sets its tenant to the tenant of
+the key, its `groups` and `groupsConfig` to the answer, and builds the ACL as for any
+user. The packages come from the provision cache, so urac is not read at all.
+
+The fallback catches an invitation made after the token was issued, the token does not
+show it yet. Everyone else gets what they got before, error 146.
+
+### When access is refused
+
+Anything but a well formed access answer is no access, and the urac driver decides:
+
+| | |
+|---|---|
+| the service is not in the registry, or has no host | logged as an error |
+| non 2xx status, `result: false`, or not JSON | logged as an error |
+| no answer within `timeout` | logged as an error |
+| `access: true` without `groupsConfig.allowedPackages` | logged as an error |
+| `access` is not `true` | not logged, a normal answer |
+
+### Behaviour
+
+- **Cost.** One API call per call under the tenant, in place of the user and groups
+  reads of urac. Invited users cost what they did before.
+- **Freshness.** Nothing is cached, adding or removing a user in the app applies on
+  their next call.
+- **Outage.** While the service is down, users of the resolver get 146 under that
+  tenant, each call after waiting up to `timeout`, keep it short. Their home tenant and
+  invited users are not affected, except users invited after their token was issued,
+  who also wait for the timeout before the fallback lets them in.
+- **Invitations win.** A user both invited and covered by the resolver gets the groups
+  of the invitation. If the invitation was made after the token was issued, they get
+  the resolver's until their next login.
+
+---
+
 ## Complete Configuration Example
 
 ```javascript
@@ -681,6 +864,22 @@ loaded from urac per request and the membership is current.
     }
   }
 }
+
+// Separate URAC custom registry entry
+{
+  "_id": ObjectId("..."),
+  "name": "urac",
+  "value": {
+    "tenantAccessResolvers": {
+      "department": {
+        "service": "departments",
+        "version": "1",
+        "api": "/tenant/access",
+        "timeout": 2000
+      }
+    }
+  }
+}
 ```
 
 ---
@@ -698,7 +897,8 @@ Custom registry configurations are processed in this order:
 | 5 | gotoService/redirectToService | `gotoService.monitor` |
 | 6 | mt (security checks) | `mt.whitelist`, `oauth.value.pinWrapper`, `oauth.value.pinWhitelist` |
 | 6a | oauth (called from mt) | `oauth.deviceIdCheck` |
-| 6b | mt (inject object) | `membership` |
+| 6b | mt (uracCheck) | `urac.value.tenantAccessResolvers` |
+| 6c | mt (inject object) | `membership` |
 | 7 | idempotency | `idempotency.model`, `idempotency.services.[name]` |
 | 8 | traffic | `traffic.model`, `traffic.throttling` |
 | 9 | cache | `cache.model`, `cache.defaultTTL`, `cache.services.[name]` |

package/docs/middleware/mt.md

@@ -285,6 +285,23 @@ PIN login is a two-factor authentication mechanism where users must enter a PIN
 - Skipped if `obj.skipOAUTH = true` or no bearer token present
 - Creates `req.soajs.uracDriver` instance
 - Handles **roaming** across environments (e.g., dashboard token used in dev environment)
+- Asks the **tenant access resolver** when a user switches to a tenant whose profile names one
+
+**Tenant Access Resolver:**
+
+A tenant can name a resolver in its profile (`profile.access`), an API of an app that answers per
+user whether they have access to the tenant and with what groups, so a group of users, a department
+for example, gets access without being invited one by one.
+
+For a call under a tenant that is not the user's home tenant, and that the token's
+`config.allowedTenants` does not list, `mw/mt/urac.js` calls the API defined in
+`registry.custom.urac.value.tenantAccessResolvers` (`mw/mt/tenantAccess.js`). On access the user
+comes from the token with that tenant and the groups of the answer, and urac is not read. No
+access, an error or a timeout falls back to the urac driver as before.
+
+See [Custom Registry, Tenant Access Resolver](../configuration-custom-registry.md#15-tenant-access-resolver)
+for the API to build, the registry entry and the tenant profile.
+To add one step by step, see the [Tenant Access Resolver Guide](../tenant-access-resolver.md).
 
 **Roaming Support:**
 
@@ -560,6 +577,7 @@ Service-level configuration that affects MT processing:
 
 - `mw/mt/utils.js` - Security check implementations
 - `mw/mt/urac.js` - URAC driver integration
+- `mw/mt/tenantAccess.js` - Tenant access resolver call
 
 ## Usage Notes
 

package/docs/multi-tenant-security.md

@@ -111,6 +111,7 @@ Loads user profile from URAC for authenticated requests.
 - Resolves user groups
 - Applies user-specific ACL overrides
 - Handles network package override for user packages
+- Asks the tenant access resolver for a user switching to a tenant that names one, see [Custom Registry](configuration-custom-registry.md#15-tenant-access-resolver)
 
 ## IP Whitelist Configuration
 

package/docs/tenant-access-resolver.md

@@ -0,0 +1,81 @@
+# Adding a Tenant Access Resolver
+
+A step by step guide to give a group of users, a department of your app for example, access
+to a tenant without inviting them one by one.
+
+Every detail lives in [Custom Registry, Tenant Access Resolver](configuration-custom-registry.md#15-tenant-access-resolver),
+this guide only walks through it in order.
+
+## Before you start
+
+- Users log in at their home tenant and switch inside the app, the resolver is asked on the
+  calls they make under the other tenant. See [When it is asked](configuration-custom-registry.md#when-it-is-asked).
+- Your app is the source of truth for who belongs to what, and its answer becomes the ACL of
+  the user under that tenant.
+
+## Step 1: Build the API
+
+In a service of your app that is in the registry, add a route that tells the gateway if a user
+has access to a tenant and with what groups.
+
+1. Read the body the gateway sends, `user`, `tenant` and `subject`.
+2. Look up whether `user` belongs to `subject` in your app.
+3. Answer with `access` and, when granted, `groups` and `groupsConfig.allowedPackages` for the
+   product of the tenant.
+
+The request and the response are in [The API to build](configuration-custom-registry.md#the-api-to-build).
+
+Keep in mind:
+
+- Keep the route out of every package ACL, the gateway calls the service directly.
+- It runs on every call the user makes under the tenant, keep it fast.
+- Anything but a well formed yes is no access, see [When access is refused](configuration-custom-registry.md#when-access-is-refused).
+
+## Step 2: Add the resolver to the custom registry
+
+In the environment's custom registry, add or edit the entry named `urac` and add your resolver
+under `tenantAccessResolvers`, giving it a name, the service, the route and a short timeout.
+
+The fields are in [The resolver](configuration-custom-registry.md#the-resolver).
+
+The name you give it is what tenants refer to, keep it stable. The service, route or timeout can
+change later without touching any tenant.
+
+## Step 3: Point the tenant at the resolver
+
+On each tenant the group should reach, set `profile.access` with the resolver name from step 2
+and the `subject` your API checks, the department id for example.
+
+See [The tenant](configuration-custom-registry.md#the-tenant).
+
+Whatever edits tenant profiles must keep `access`, `PUT /tenant/profile` replaces the whole
+profile.
+
+## Step 4: Check it
+
+With a user of the group, logged in at their home tenant:
+
+1. Call an API of the tenant with their token and the tenant's key. It should succeed with the
+   packages your API returned.
+2. Call it with a user outside the group. It should fail with error 146, as before.
+3. Call it with a user invited to the tenant. Your API is not called, the invitation decides.
+
+If a user of the group gets 146, look for `Tenant access resolver` in the gateway logs, every
+failed call is logged with the resolver, the user and the tenant.
+
+Changes in your app apply on the next call. Changes to the tenant profile apply once the key
+cache refreshes.
+
+## Before going live
+
+Read [Behaviour](configuration-custom-registry.md#behaviour): what each call costs, what users
+see while your service is down, and how invitations and the resolver combine.
+
+## Reference
+
+| Topic | Where |
+|-------|-------|
+| Full reference | [Custom Registry, Tenant Access Resolver](configuration-custom-registry.md#15-tenant-access-resolver) |
+| Where it runs in the pipeline | [MT middleware, uracCheck](middleware/mt.md#6-uraccheck) |
+| Code | `mw/mt/urac.js`, `mw/mt/tenantAccess.js` |
+| Example test | `test/integration/UC5-tenant-access/index.js`, a mock resolver |

package/mw/mt/lib.js

@@ -45,7 +45,7 @@ module.exports = {
 				async.eachOfSeries(service, function (version, versionValue, versionCall) {
 					if (!acl.acl[serviceName][versionValue]) {
 						acl.acl[serviceName][versionValue] = _.cloneDeep(version);
-						return serviceCall();
+						return versionCall();
 					}
 					if (version.apisPermission === "restricted") {
 						if (acl.acl[serviceName] && acl.acl[serviceName][versionValue] && acl.acl[serviceName][versionValue].apisPermission && acl.acl[serviceName][versionValue].apisPermission === "restricted") {
@@ -89,7 +89,7 @@ module.exports = {
 					async.eachOf(service, function (version, versionValue, versionCall) {
 						if (!acl.acl_all_env[envName][serviceName][versionValue]) {
 							acl.acl_all_env[envName][serviceName][versionValue] = _.cloneDeep(version);
-							return serviceCall();
+							return versionCall();
 						}
 						if (version.apisPermission === "restricted") {
 							if (acl.acl_all_env[envName][serviceName][versionValue].apisPermission && acl.acl_all_env[envName][serviceName][versionValue].apisPermission === "restricted") {

package/mw/mt/tenantAccess.js

@@ -0,0 +1,173 @@
+"use strict";
+
+/**
+ * @license
+ * Copyright SOAJS All Rights Reserved.
+ *
+ * Use of this source code is governed by an Apache license that can be
+ * found in the LICENSE file at the root of this repository
+ */
+
+const { httpRequestLight } = require("../../lib/request.js");
+
+const get = (p, o) => p.reduce((xs, x) => (xs && xs[x]) ? xs[x] : null, o);
+
+const DEFAULT_TIMEOUT = 2000;
+
+/**
+ * Find the resolver that decides who can access the tenant of this request.
+ *
+ * NOTE: the tenant profile names the resolver, the urac custom registry defines what to call,
+ *       so the call can move without touching every tenant
+ *
+ * @param soajs
+ * @returns {null|{name, subject, service, version, method, api, timeout}}
+ */
+function getResolver(soajs) {
+	let access = get(["tenant", "profile", "access"], soajs);
+	if (!access || !access.resolver) {
+		return null;
+	}
+	let resolver = get(["registry", "custom", "urac", "value", "tenantAccessResolvers", access.resolver], soajs);
+	if (!resolver || !resolver.service || !resolver.api) {
+		if (soajs.log && soajs.log.error) {
+			soajs.log.error("Tenant access resolver [" + access.resolver + "] of tenant [" + soajs.tenant.code + "] is not defined in the urac custom registry");
+		}
+		return null;
+	}
+	return {
+		"name": access.resolver,
+		"subject": access.subject || null,
+		"service": resolver.service,
+		"version": resolver.version || null,
+		"method": resolver.method || "post",
+		"api": resolver.api,
+		"timeout": resolver.timeout || DEFAULT_TIMEOUT
+	};
+}
+
+/**
+ * The service behind the resolver has not been through the gateway, give it the tenant and key
+ * of this request the same way the gateway does, without any ACL or user
+ *
+ * @param soajs
+ * @param serviceName
+ * @returns {string}
+ */
+function buildInjectObj(soajs, serviceName) {
+	let tenant = soajs.tenant;
+	let injectObj = {
+		"tenant": {
+			"id": tenant.id,
+			"name": tenant.name,
+			"code": tenant.code,
+			"locked": tenant.locked,
+			"type": tenant.type
+		},
+		"key": {
+			"config": {},
+			"iKey": tenant.key.iKey,
+			"eKey": tenant.key.eKey
+		},
+		"application": {
+			"product": tenant.application.product,
+			"package": tenant.application.package,
+			"appId": tenant.application.appId
+		}
+	};
+	if (tenant.main) {
+		injectObj.tenant.main = tenant.main;
+	}
+	if (soajs.servicesConfig) {
+		if (soajs.servicesConfig.commonFields) {
+			injectObj.key.config.commonFields = soajs.servicesConfig.commonFields;
+		}
+		if (soajs.servicesConfig[serviceName]) {
+			injectObj.key.config[serviceName] = soajs.servicesConfig[serviceName];
+		}
+	}
+	return JSON.stringify(injectObj);
+}
+
+/**
+ * Ask the resolver if the user has access to the tenant of this request and with what groups.
+ *
+ * NOTE: anything but a well formed yes is no access, the caller falls back to the urac driver
+ *       so an invitation made after the token was issued still works
+ *
+ * @param soajs
+ * @param user the user from the token
+ * @param resolver from getResolver
+ * @param cb (result) result is {groups, groupsConfig} or null
+ */
+function resolve(soajs, user, resolver, cb) {
+	let done = (result) => {
+		//NOTE: out of the promise, an error thrown further down must not come back here as a rejection
+		process.nextTick(() => {
+			return cb(result);
+		});
+	};
+	let label = "Tenant access resolver [" + resolver.name + "] for user [" + user.username + "] and tenant [" + soajs.tenant.code + "]";
+
+	if (!soajs.registry || !soajs.registry.services ||
+		!soajs.registry.services[resolver.service] || !soajs.registry.services[resolver.service].port) {
+		soajs.log.error(label + " failed, service [" + resolver.service + "] is not in the registry");
+		return done(null);
+	}
+	soajs.awareness.getHost(resolver.service, resolver.version, (host) => {
+		if (!host) {
+			soajs.log.error(label + " failed, no host for [" + resolver.service + "@" + resolver.version + "]");
+			return done(null);
+		}
+		let data = {
+			"user": {
+				"id": user.id || (user._id ? user._id.toString() : null),
+				"username": user.username,
+				"tenant": {
+					"id": user.tenant.id,
+					"code": user.tenant.code
+				}
+			},
+			"tenant": {
+				"id": soajs.tenant.id,
+				"code": soajs.tenant.code
+			},
+			"subject": resolver.subject
+		};
+		if (soajs.tenant.main) {
+			data.tenant.main = soajs.tenant.main;
+		}
+		httpRequestLight({
+			"uri": "http://" + host + ":" + soajs.registry.services[resolver.service].port + resolver.api,
+			"method": resolver.method,
+			"data": data,
+			"headers": { "soajsinjectobj": buildInjectObj(soajs, resolver.service) },
+			"timeout": resolver.timeout
+		}).then((response) => {
+			let answer = (response && response.result === true) ? response.data : null;
+			if (!answer || typeof answer !== "object") {
+				soajs.log.error(label + " returned an invalid response");
+				return done(null);
+			}
+			if (answer.access !== true) {
+				return done(null);
+			}
+			if (!answer.groupsConfig || !answer.groupsConfig.allowedPackages || typeof answer.groupsConfig.allowedPackages !== "object") {
+				soajs.log.error(label + " granted access without groupsConfig.allowedPackages");
+				return done(null);
+			}
+			return done({
+				"groups": Array.isArray(answer.groups) ? answer.groups : [],
+				"groupsConfig": answer.groupsConfig
+			});
+		}).catch((error) => {
+			soajs.log.error(label + " failed: " + error.message);
+			return done(null);
+		});
+	});
+}
+
+module.exports = {
+	"getResolver": getResolver,
+	"resolve": resolve
+};

package/mw/mt/urac.js

@@ -13,6 +13,7 @@ const coreModules = require("soajs.core.modules");
 let provision = coreModules.provision;
 
 const lib = require("./lib.js");
+const tenantAccess = require("./tenantAccess.js");
 
 const get = (p, o) => p.reduce((xs, x) => (xs && xs[x]) ? xs[x] : null, o);
 
@@ -57,6 +58,31 @@ function Urac(param) {
 			_self.username = param.username;
 		}
 	}
+
+	//NOTE: a user switching to a tenant that names a resolver in its profile is decided by the resolver,
+	//		unless the token already shows an invitation to that tenant, invitations keep going through
+	//		the urac driver
+	_self.tenantAccess = null;
+	if (!_self.userRecord && _self.id && _self.bearerTokenUser && _self.soajs.tenant && !_self.soajs.tenant.roaming) {
+		let user = _self.bearerTokenUser;
+		if (user.tenant && user.tenant.id !== _self.soajs.tenant.id && !isInvited(user, _self.soajs.tenant.id)) {
+			_self.tenantAccess = tenantAccess.getResolver(_self.soajs);
+		}
+	}
+}
+
+/**
+ * Check the allowedTenants of the user from the token
+ * @param user
+ * @param tenantId
+ * @returns {boolean}
+ */
+function isInvited(user, tenantId) {
+	let allowedTenants = get(["config", "allowedTenants"], user);
+	if (!Array.isArray(allowedTenants)) {
+		return false;
+	}
+	return allowedTenants.some((item) => item && item.tenant && item.tenant.id === tenantId);
 }
 
 /**
@@ -75,20 +101,43 @@ Urac.prototype.init = function (cb) {
 		}
 	}
 	else if (_self.id) {
-		uracDriver.getRecord(_self.soajs, { id: _self.id.toString(), username: _self.username }, function (err, record) {
-			if (record) {
-				_self.userRecord = record;
-				_self.resolveACL(() => {
-					return cb(null, _self.userRecord);
-				});
-			} else {
-				if (err && err.msg) {
-					const code = err.code;
-					err = new Error(err.msg);
-					err.code = code;
+		let getRecord = () => {
+			uracDriver.getRecord(_self.soajs, { id: _self.id.toString(), username: _self.username }, function (err, record) {
+				if (record) {
+					_self.userRecord = record;
+					_self.resolveACL(() => {
+						return cb(null, _self.userRecord);
+					});
+				} else {
+					if (err && err.msg) {
+						const code = err.code;
+						err = new Error(err.msg);
+						err.code = code;
+					}
+					return cb(err, null);
 				}
-				return cb(err, null);
+			});
+		};
+		if (!_self.tenantAccess) {
+			return getRecord();
+		}
+		tenantAccess.resolve(_self.soajs, _self.bearerTokenUser, _self.tenantAccess, (result) => {
+			//NOTE: no access from the resolver falls back to the urac driver, it catches an invitation
+			//		made after the token was issued and answers everyone else as before
+			if (!result) {
+				return getRecord();
 			}
+			_self.userRecord = Object.assign({}, _self.bearerTokenUser, {
+				"tenant": {
+					"id": _self.soajs.tenant.id,
+					"code": _self.soajs.tenant.code
+				},
+				"groups": result.groups,
+				"groupsConfig": result.groupsConfig
+			});
+			_self.resolveACL(() => {
+				return cb(null, _self.userRecord);
+			});
 		});
 	} else {
 		let error = new Error('oAuth userId is not available to pull URAC profile');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.3.16",
+  "version": "4.3.18",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"
@@ -30,7 +30,7 @@
     "path-to-regexp": "8.4.2",
     "soajs.core.libs": "1.2.2",
     "soajs.core.modules": "5.2.21",
-    "soajs.urac.driver": "3.2.17",
+    "soajs.urac.driver": "3.2.18",
     "useragent": "2.3.0"
   },
   "devDependencies": {