Admin Console

Menu Structure

This page documents the OSS contexa-iam admin surface. The current default menu tree is created by AdminMenuService and exposes five top-level groups: Dashboard, Policy, Access, IAM, and Security. Zero Trust operations are currently presented under the Security group rather than as a separate top-level menu.

Controllers

Most admin controllers are served under the /admin base path and return Thymeleaf template views. Some controllers (for example PasswordChangeController) use different base paths.

Policy Center

Access: /admin/policy-center

The Policy Center is the unified hub for current OSS policy operations. The current OSS template exposes four operator surfaces: Create, List, Simulator, and Matrix. Resource review and permission definition are integrated into the Create surface; older routes such as /admin/workbench/resources and /admin/policy-builder still exist in code, but the primary OSS UI is policy-center.html.

Create Surface (Resources + Policy Creation)

The Create surface combines resource review/definition with the current policy creation modes.

• Resources area: Review discovered resources, define permissions, exclude or restore resources, and launch policy creation from the selected resource context.
• Quick Mode: Role-permission mapping with search and chip-based selection. Creates a basic ALLOW policy.
• Manual Mode: Full policy form with dynamic Target (URL/METHOD), Rule, and Condition (SpEL) editing. Directly creates Policy/PolicyTarget/PolicyRule/PolicyCondition entities.
• AI Mode: Assisted policy draft generation inside Policy Center using current roles, permissions, conditions, and policy context. The generated draft remains subject to the normal save, approval, and activation rules.

List Surface

Server-side paginated policy list with keyword search. Edit and delete actions are wired through POST-based form flows and detail pages.

Simulator Surface

Runs policy what-if checks against selected users, permissions, and conditions using the simulator APIs exposed from PolicyCenterController.

Matrix Surface

Builds the policy matrix view through the matrix APIs exposed by PolicyCenterController and PolicyMatrixService.

Security Monitor

Access: /admin/security-monitor

Real-time security event viewer based on the audit_log table. All queries use DB-level pagination to handle millions of records.

Dashboard Drill-Down

Dashboard links navigate to Security Monitor with pre-applied filters. The current dashboard exposes both Zero Trust decision cards and security indicator cards.

Dashboard

The Dashboard (/admin, /admin/, /admin/dashboard) provides a comprehensive security overview with data aggregated from audit_log over the last 24 hours.

Sections

• Policy Status: Total policies, active resources, and protection coverage
• Zero Trust Decisions: Donut chart with ALLOW/CHALLENGE/BLOCK/ESCALATE/DENY breakdown and drill-down cards for ALLOW/CHALLENGE/BLOCK/ESCALATE
• Authentication Stats: Semi-circle gauge showing success/failure ratio
• Security Indicators: Drill-down links for after-hours access, security decision events, admin overrides, distinct IPs, high-risk records, and security errors
• Threat Events: Recent high-risk events with direct links to Security Monitor detail
• Blocked Users: Recently blocked users by the Zero Trust engine

Access Center

Access: /admin/access-center

Unified interface for managing the entire identity chain (User -> Group -> Role -> Permission) in a single tabbed view. The current template exposes four tabs: Users, Groups, Roles, and Overview.

Users Tab

Search users and manage their group and direct-role assignments. User detail shows groups, direct roles, group-inherited roles, and effective permissions. When assigning direct roles, the current client can also persist CRUD subsets per role through UserRolePermission.

Groups Tab

View all groups with assigned roles and current members. Group-role mappings are updated here, and the current client can also persist CRUD subsets per group-role pair through GroupRolePermission.

Roles Tab

View all roles with their permissions and directly assigned users. This tab updates the permission set of a role.

Overview Tab

The Overview tab shows current counts for users, groups, roles, and permissions, plus a summary diagram explaining the User -> Group -> Role -> Permission structure.

Identity Management

Standard CRUD operations for Users (/admin/users), Groups (/admin/groups), Roles (/admin/roles), and Permissions (/admin/permissions).

The access chain is User -> Group -> Role -> Permission. Users inherit permissions through group membership and direct role assignment.

Role Hierarchies

Access: /admin/role-hierarchies

Parent roles automatically inherit all permissions from child roles. The hierarchy is resolved by Spring Security's RoleHierarchy and considered during CustomDynamicAuthorizationManager runtime evaluation.

Password Policy

Access: /admin/password-policy

Configures password rules used during registration and password change flows.

System Settings

Access: /admin/system-settings

System-wide IAM settings exposed in the OSS admin surface.

Menu Management

Access: /admin/menu-management

Administrative menu tree management for the current admin navigation structure.

Zero Trust Operations

Security Monitor

Access: /admin/security-monitor

Real-time audit log viewer with time-range filters (1h/6h/24h/3d), category filters (AI Analysis, Auth Failure, Admin Override), and DB-level pagination for millions of records.

Blocked Users

Access: /admin/blacklist

Manages users blocked by the Zero Trust engine. Supports filtering by status (BLOCKED, UNBLOCK_REQUESTED, RESOLVED, TIMEOUT_RESPONDED) and resolution workflows by administrators.

Security Management

IP Management

Access: /admin/ip-management

Manage IP-based access rules with ALLOW/DENY types. Supports IPv4/IPv6 addresses and CIDR notation. Rules can have optional expiration dates and can be toggled on/off. Export rules to CSV.

Session Management

Access: /admin/session-management

Monitor active user sessions with pagination and search. Displays session ID, username, client IP, user agent, login time, and last activity. Supports forced session invalidation (single session or all sessions for a user). Export sessions to CSV.

Password Policy

Access: /admin/password-policy

Configure password policy rules: minimum/maximum length, uppercase requirement, lowercase requirement, digit requirement, and special character requirement. Policy rules are enforced during user registration and password changes.

AI Policy Generation

The AI policy generation system uses SSE streaming to create policies from natural language requirements.

API Endpoints

How It Works

1. User enters a natural language requirement (e.g., "Allow developers to access /api/** during business hours")
2. AdvancedPolicyGenerationLab enriches the request with all available roles, permissions, and conditions from the database
3. PolicyGenerationContextRetriever searches vector DB for similar policy patterns (RAG)
4. AI generates a PolicyResponse with roleIds, permissionIds, conditions, and ID-to-name mappings
5. Frontend validates the response against available items and renders a preview
6. User confirms and saves -- BusinessPolicyService creates Policy + PolicyTarget + PolicyRule + PolicyCondition entities
7. CustomDynamicAuthorizationManager reloads and the policy takes effect immediately

Admin Console Architecture

The current OSS admin surface combines navigation groups and operational areas. The boxes below reflect the current menu tree and the major integrated workspaces.

Getting Started

A complete walkthrough from deployment to fully dynamic authorization:

Configuration Properties

contexa:
  iam:
    admin:
      rest-docs-path: /docs/index.html  # Path to REST API documentation