Project

General

Profile

Actions
Copy link

Bug #26602

closed

User with "compliance" perm get error on group, directive pages

Added by Nicolas CHARLES 25 days ago. Updated 8 days ago.

Status:
Released
Priority:
N/A
Assignee:
François ARMAND
Category:
Web - Nodes & inventories
Target version:
8.3.0~rc1
Pull Request:
https://github.com/Normation/rudder/p...
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
Yes

Description

When using a user with the "compliance" permission and only that one, when we get on a group detail, we have two errors regarding server error.

The same kind of error happens on directive, and rule, node (see screenshots).

=> only the compliance tab of nodes, rules, directives, groups should be accessible for a user with only compliance perm.

Plus that permission profile has access to techniques and global properties : he should not.

Seen in 8.3, but the behavior is likely also incorrect in 8.2.

It happens also on the node details

and the rules page

Files

Download all files
clipboard-202503241411-ac1in.png (88.5 KB) clipboard-202503241411-ac1in.png Nicolas CHARLES, 2025-03-24 14:11
clipboard-202503241424-ml8rx.png (214 KB) clipboard-202503241424-ml8rx.png Nicolas CHARLES, 2025-03-24 14:24
clipboard-202503241425-irwu9.png (229 KB) clipboard-202503241425-irwu9.png Nicolas CHARLES, 2025-03-24 14:25
clipboard-202503271530-ojrig.png (354 KB) clipboard-202503271530-ojrig.png Clark ANDRIANASOLO, 2025-03-27 15:30
clipboard-202503271530-ec7z7.png (354 KB) clipboard-202503271530-ec7z7.png Clark ANDRIANASOLO, 2025-03-27 15:30

Related issues 2 (1 open — 1 closed)

Related to Rudder - Architecture #24872: Rework api authorization modelsReleasedVincent MEMBRÉActions
Related to Rudder - Bug #26642: Compliance right should not give access to techniques and global parametersPending technical reviewFrançois ARMANDActions
Actions
Copy link
 #1

Updated by Nicolas CHARLES 25 days ago

  • Description updated (diff)
Actions
Copy link
 #4

Updated by Nicolas CHARLES 25 days ago

Log say

2025-03-24 13:26:24+0000 INFO  api-processing.response-error - "Authorization error: User 'dev' is not allowed to access GET secure/api/user/api/token/status" 
2025-03-24 13:26:26+0000 WARN  api-processing - User 'dev' is not authorized to access API 'writeFileResource
2025-03-24 13:26:26+0000 INFO  api-processing.response-error - "User 'dev' is not authorized to access API 'writeFileResource" 
2025-03-24 13:26:26+0000 WARN  api-processing - Authorization error for 'GET secure/api/user/api/token/status': User 'dev' is not allowed to access GET secure/api/user/api/token/status
2025-03-24 13:26:26+0000 INFO  api-processing.response-error - "Authorization error: User 'dev' is not allowed to access GET secure/api/user/api/token/status" 
2025-03-24 13:26:30+0000 WARN  api-processing - Authorization error for 'GET secure/api/settings/global_policy_mode': User 'dev' is not allowed to access GET secure/api/settings/{key}

Actions
Copy link
 #5

Updated by François ARMAND 25 days ago

  • Status changed from New to In progress
  • Assignee set to François ARMAND
Actions
Copy link
 #6

Updated by François ARMAND 25 days ago

  • Subject changed from Error when Getting Policy Mode, details: The server had a problem, try again later to User with "compliance" perm get error on group, directive pages
  • Description updated (diff)
  • Priority changed from N/A to 1 (highest)
  • Target version changed from 8.3.0~rc1 to 8.2.6
Actions
Copy link
 #7

Updated by François ARMAND 25 days ago

  • Description updated (diff)
Actions
Copy link
 #8

Updated by François ARMAND 25 days ago

  • Status changed from In progress to New
  • Assignee changed from François ARMAND to Clark ANDRIANASOLO
Actions
Copy link
 #9

Updated by François ARMAND 22 days ago

  • Priority changed from 1 (highest) to N/A
  • Target version changed from 8.2.6 to 8.3.0~rc1
Actions
Copy link Download all files
 #10

Updated by Clark ANDRIANASOLO 22 days ago

So there are actual bugs, and the restriction of the content needs to be fixed in 8.2, in a separate issue :
  • in 8.3 the bug is that the rights for the policy mode endpoints have changed (in #24872)
  • there is another bug : the Administration menu is present and redirects to a 404 page, whereas in 8.2 it has a sub-menu for the "Techniques tree"

In 8.2, we will need to decide if we need to remove the access to the global properties and techniques + the techniques tree, it does not seem to be trivial on 8.3 directly since we have new tab and menu structures

Actions
Copy link
 #11

Updated by Clark ANDRIANASOLO 22 days ago

Actions
Copy link
 #12

Updated by Clark ANDRIANASOLO 22 days ago

  • Status changed from New to In progress
Actions
Copy link
 #13

Updated by Clark ANDRIANASOLO 22 days ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from Clark ANDRIANASOLO to François ARMAND
  • Pull Request set to https://github.com/Normation/rudder/pull/6291
Actions
Copy link
 #14

Updated by Clark ANDRIANASOLO 22 days ago

  • Related to Bug #26642: Compliance right should not give access to techniques and global parameters added
Actions
Copy link
 #15

Updated by Clark ANDRIANASOLO 22 days ago

  • Status changed from Pending technical review to Pending release
Actions
Copy link
 #16

Updated by Vincent MEMBRÉ 8 days ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 8.3.0~rc1 which was released today.

Actions
Copy link

Also available in: Atom PDF