[Geoserver-devel] [JIRA] (GEOS-7829) When GeoFence option "Use GeoServer roles to get authorizations" is activated users specific rules will also be selected

GeoServer GeoServer Developer
1

Nuno Oliveira created an issue

GeoServer / BugGEOS-7829

When GeoFence option “Use GeoServer roles to get authorizations” is activated users specific rules will also be selected

Issue Type:

BugBug

Assignee:

Unassigned

Components:

Community modules, GeoFence

Created:

30/Oct/16 4:37 PM

Priority:

MediumMedium

Reporter:

Nuno Oliveira

When GeoFence option “Use GeoServer roles to get authorizations” is activated, if someone defines a rule allowing a certain user to do something then everyone will inherit those permissions.

For example if we define a rule allowing a certain user to do everything everyone will be allowed to do everything.

This is a consequence of how the filter to select the matching rules is build, when the option above is activated users column is ignored:
https://github.com/geoserver/geoserver/blob/master/src/community/geofence/src/main/java/org/geoserver/geofence/GeofenceAccessManager.java#L394-L423

To reproduce this issue just activate the option “Use GeoServer roles to get authorizations” on GeoFence configuration page and define a single rule allowing only a specific user to do everything. Logout and try to do something, no restrictions will be applied.

The original use case that motivated this option was very specific and not needed anymore.

Add Comment

Add Comment

This message was sent by Atlassian JIRA (v1000.482.3#100017-sha1:2ae3eee)

Atlassian logo