Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes #12440: When the api authorization plugin is disabled tokens become read only #2578

Merged
merged 1 commit into from
Nov 12, 2019
Merged

Fixes #12440: When the api authorization plugin is disabled tokens become read only #2578

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions ...ources/rudder/rudder-rest/src/main/scala/com/normation/rudder/rest/ApiAuthorization.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,10 +137,11 @@ class AclApiAuthorization(logger: Log, userService: UserService, aclEnabled: ()
logger.warn(s"API account linked to a user account '${user.actor.name}' is disabled because the API Authorization plugin is disabled.")
None //token link to user account is a plugin only feature

// without plugin but ACL configured, standard api account are change to RO to avoid unwanted mod
// without plugin but ACL configured, standard api account are change to "no right" to avoid unwanted mod
// (making them "ro" could give the token MORE rights than with the plugin - ex: token only have "ro" on compliance)
case (false, ApiAuthz.ACL(acl), RudderAccount.Api(ApiAccount(_, _:ApiAccountKind.PublicApi, _, _, _, _, _, _))) =>
logger.info(s"API account '${user.actor.name}' has ACL authorization but no plugin allows to interpret them. Revert to R0 rights.")
checkRO(endpoint.schema.action)
logger.info(s"API account '${user.actor.name}' has ACL authorization but no plugin allows to interpret them. Removing all rights for that token.")
None

// in other cases, we interpret rights are they are reported (system user has ACL or RW independently of plugin status)
case (_ , ApiAuthz.None, _) =>
Expand Down