[jboss-jira] [JBoss JIRA] (WFLY-1980) Revisit priviledges for /core-service=management/access=authorization
[
https://issues.jboss.org/browse/WFLY-1980?page=com.atlassian.jira.plugin....
]
Brian Stansberry resolved WFLY-1980.
------------------------------------
Resolution: Done
Fixed by actually applying the constraint. Also, the constraint make "address"
sensitive, which isn't ideal for /core-service=management/access=authorization but is
appropriate for many sub-resources. IMO the non-ideal situation for the parent resource is
minor, and the alternative of having separate a separate classification for the children
is worse.
Revisit priviledges for
/core-service=management/access=authorization
---------------------------------------------------------------------
Key: WFLY-1980
URL: https://issues.jboss.org/browse/WFLY-1980
Project: WildFly
Issue Type: Sub-task
Components: Domain Management
Reporter: Heiko Braun
Assignee: Brian Stansberry
Fix For: 8.0.0.Beta1
It seems the access control resources (/core-service=management/access=authorization) are
addressable by the monitor role:
{noformat}
[standalone@localhost:9990 /]
/core-service=management/access=authorization:read-resource(){roles=monitor}
{
"outcome" => "success",
"result" => {
"provider" => "simple",
"use-realm-roles" => false,
"constraint" => {
"application-classification" => undefined,
"sensitivity-classification" => undefined,
"vault-expression" => undefined
},
"role-mapping" => {"SuperUser" => undefined}
}
}
{noformat}
I think it should be 'addressable=false' for anybody except SuperUser and
Administrator
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira