Fix test token being rejected under group-based access#201
Merged
Conversation
The user info fabricated for the test token carried the roles admin and user and no groups. The endpoint recognizes ndp_admin, not admin, so with ENABLE_GROUP_BASED_ACCESS enabled the test user failed the entry check: /user/info returned 403 and the UI refused it. Even when admitted it resolved to no effective role, so it could exercise nothing. The test token now carries ndp_admin, the role it is meant to represent, so it passes group-based access and resolves to admin everywhere. Closes #200
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #200
Problem
The test token is meant to grant full access without contacting the authentication service. On an endpoint with
ENABLE_GROUP_BASED_ACCESS=Trueit was refused: signing in through the UI with the test token returned 403.The fabricated user carried the roles
adminanduserand belonged to no groups. The endpoint's platform admin role isndp_admin, notadmin, so entry — which requires an allowed group,ndp_admin, or the endpoint's own group — was denied. Even where the token was admitted, it resolved to no effective role and could exercise no write or management action.This was reported from the field on the FARSITE endpoint, which has group-based access enabled.
Fix
The test token now carries
ndp_admin, the role it is meant to represent. One line, in the fabricated user info.Verified
New regression tests in
tests/test_test_token_access.pycover the reported scenario directly: with group-based access enabled and an allowed group configured, the test user (in no groups) is admitted, is recognized as admin, and resolves to theadmineffective role.black --checkandflake8cleanNo routes or request/response shapes change; only the roles reported for the test token.