Project

General

Profile

Bug #12440

When the api authorization plugin is disabled tokens become read only

Added by Benoît PECCATTE about 2 years ago. Updated 6 months ago.

Status:
Released
Priority:
N/A
Target version:
Severity:
Critical - prevents main use of Rudder | no workaround | data loss | security
User visibility:
Infrequent - complex configurations | third party integrations
Effort required:
Very Small
Priority:
78

Description

This could be a security problem if the token had restricted read rights, the token then have full access.
The token could instead be interpreted as disabled.


Related issues

Related to Rudder - User story #12111: Make fine-grained API authorization a pluginReleasedFrançois ARMANDActions
#1

Updated by François ARMAND about 2 years ago

#2

Updated by François ARMAND about 2 years ago

See comment/implementation on PR for #12111: https://github.com/Normation/rudder/pull/1858

#3

Updated by François ARMAND about 2 years ago

#4

Updated by François ARMAND about 2 years ago

#5

Updated by Alexis MOUSSET about 2 years ago

  • Subject changed from When the api aithorization plugin is disabled tokens become read only to When the api authorization plugin is disabled tokens become read only
#6

Updated by Benoît PECCATTE almost 2 years ago

  • Project changed from Private plugins common to Rudder
  • Category set to 102
  • Severity set to Critical - prevents main use of Rudder | no workaround | data loss | security
  • User visibility set to Infrequent - complex configurations | third party integrations
  • Priority changed from 0 to 64
#7

Updated by Benoît PECCATTE almost 2 years ago

  • Assignee set to Vincent MEMBRÉ
#8

Updated by Vincent MEMBRÉ almost 2 years ago

  • Project changed from Rudder to API Authorizations
  • Category deleted (102)
  • Target version set to 444
  • Priority changed from 64 to 62
#9

Updated by François ARMAND over 1 year ago

  • Effort required set to Very Small
  • Priority changed from 62 to 86
#10

Updated by François ARMAND over 1 year ago

Need ot be checked again for the actual status.

"Disable" is better than intersection of "read /\ acls rights" because muech simpler to understand for the user.

#11

Updated by François ARMAND over 1 year ago

  • Assignee changed from Vincent MEMBRÉ to François ARMAND
  • Priority changed from 86 to 82
#12

Updated by François ARMAND 7 months ago

  • Target version changed from 444 to 5.0-1.5
  • Priority changed from 82 to 78
#13

Updated by François ARMAND 7 months ago

  • Status changed from New to In progress
#14

Updated by François ARMAND 7 months ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from François ARMAND to Nicolas CHARLES
  • Pull Request set to https://github.com/Normation/rudder/pull/2578
#15

Updated by François ARMAND 7 months ago

  • Status changed from Pending technical review to Pending release
#16

Updated by Vincent MEMBRÉ 6 months ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 5.0-1.5 which was released today.

Also available in: Atom PDF