Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict permissions for adding scopes or manipulating identities #6267

Closed
dchristidis opened this issue Jul 18, 2023 · 2 comments · Fixed by #6274 or #6284
Closed

Restrict permissions for adding scopes or manipulating identities #6267

dchristidis opened this issue Jul 18, 2023 · 2 comments · Fixed by #6274 or #6284
Assignees
@dchristidis
Labels
Authentication & Authorisation backport Issues which are backported to additional releases bug
Milestone
32.0.0

Comments

@dchristidis
Copy link
Contributor

Description

It has come to our attention that some permissions are not restrictive enough. Specifically:

  • Adding new scopes (perm_add_scope)
  • Adding new identities (perm_add_account_identity)
  • Deleting existing identities (perm_del_account_identity)

For the latter two, they can only affect one’s own account, but it should probably be restricted nonetheless.

Steps to reproduce

The snippet below, run as user jdoe, does not raise an error:

$ rucio-admin scopes add --account jdoe --scope covfefe

Rucio Version

No response

Additional Information

Affected policies are:

  • atlas.py
  • cms.py
  • escape.py
  • generic.py
  • generic_multi_vo.py

We’ll certainly change it for ATLAS and the generic policies. @ericvaandering and @egazzarr, thoughts for CMS and ESCAPE respectively?
@dchristidis dchristidis added bug Authentication & Authorisation backport Issues which are backported to additional releases labels Jul 18, 2023
@dchristidis dchristidis self-assigned this Jul 18, 2023
@ericvaandering
Copy link
Contributor

We are now using a policy package, but it probably has these issue. @dynamic-entropy want to take a look?

@dchristidis dchristidis linked a pull request Jul 20, 2023 that will close this issue
Authentication: Restrict some permissions #6267 #6274
Merged
dchristidis added a commit to dchristidis/rucio that referenced this issue Jul 21, 2023
@dchristidis
Authentication: Restrict some permissions rucio#6267
8a90bb3 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.
dchristidis added a commit to dchristidis/rucio that referenced this issue Jul 21, 2023
@dchristidis
Authentication: Restrict some permissions rucio#6267
088f19f 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.
dchristidis added a commit to dchristidis/rucio that referenced this issue Jul 21, 2023
@dchristidis
Authentication: Restrict some permissions rucio#6267
4562812 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.
dchristidis added a commit to dchristidis/rucio that referenced this issue Jul 24, 2023
@dchristidis
Authentication: Restrict some permissions rucio#6267
f21356f 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.
dchristidis added a commit to dchristidis/rucio that referenced this issue Jul 24, 2023
@dchristidis
Authentication: Restrict some permissions rucio#6267
5c7a1c4 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.

Some test needed to be adapted to the changes.
bari12 pushed a commit that referenced this issue Jul 25, 2023
@dchristidis @bari12
Authentication: Restrict some permissions #6267
e53ca96 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.

Some test needed to be adapted to the changes.
@bari12
Copy link
Member

bari12 commented Jul 25, 2023

Backport 1.29.14

dchristidis added a commit to dchristidis/rucio that referenced this issue Jul 25, 2023
@dchristidis
Authentication: Restrict some permissions rucio#6267
1a78e8a 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.

Some test needed to be adapted to the changes.
@dchristidis dchristidis linked a pull request Jul 25, 2023 that will close this issue
Authentication: Restrict some permissions #6267 #6284
Merged
dchristidis added a commit to dchristidis/rucio that referenced this issue Jul 25, 2023
@dchristidis
Authentication: Restrict some permissions rucio#6267
50d7817 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.

Some test needed to be adapted to the changes.
bari12 pushed a commit that referenced this issue Jul 31, 2023
@dchristidis @bari12
Authentication: Restrict some permissions #6267
e80c4dd 
This affects the following:

* Adding new scopes (perm_add_scope)
* Adding new identities (perm_add_account_identity)
* Deleting existing identities (perm_del_account_identity)

Previously, they were unrestricted (for the latter two, they could only
affect one's own account). Instead, they will now require administrative
privileges.

Some test needed to be adapted to the changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dchristidis dchristidis

Labels
Authentication & Authorisation backport Issues which are backported to additional releases bug
Projects
None yet
Milestone
32.0.0
3 participants
@bari12 @ericvaandering @dchristidis