You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2022/03/03 19:04:21 UTC

[GitHub] [trafficcontrol] shamrickus opened a new issue #6609: Missing Permissions in DB seed/migration

shamrickus opened a new issue #6609:
URL: https://github.com/apache/trafficcontrol/issues/6609


   <!--
   ************ STOP!! ************
   If this issue identifies a security vulnerability, DO NOT submit it! Instead, contact
   the Apache Traffic Control Security Team at security@trafficcontrol.apache.org and follow the
   guidelines at https://apache.org/security regarding vulnerability disclosure.
   
   - For *SUPPORT QUESTIONS*, use the #traffic-control channel on the ASF slack (https://s.apache.org/tc-slack-request)
   or the Traffic Control Users mailing list (send an email to users-subscribe@trafficcontrol.apache.org to subscribe).
   - Before submitting, please **SEARCH GITHUB** for a similar issue or PR
       * https://github.com/apache/trafficcontrol/issues
       * https://github.com/apache/trafficcontrol/pulls
   -->
   
   <!-- Do not submit security vulnerabilities or support requests here - see above -->
   ## This Bug Report affects these Traffic Control components:
   <!-- delete all those that don't apply -->
   - Traffic Ops
   
   ## Current behavior:
   The following permissions are not seeded in the database:
   ```
   CDNI-CAPACITY:UPDATE (OC/CI/configuration/, OC/CI/configuration/{host})
   CDNI-CAPACITY:ADMIN (OC/CI/configuration/request/{id}/{approved})
   
   SSL-KEY-EXPIRATION:READ (sslkey_expirations/)
   
   ACME:READ (acme_accounts/providers)
   ACME:READ (deliveryservices/sslkeys/generate/acme/)
   ACME:READ/CREATE/UPDATE (acme_accounts/)
   ACME:READ/DELETE (acme_accounts/{provider}/{email})
   ACME:READ (acme_autorenew/)
   
   DBDUMP:READ (dbdump/?)
   
   ROLE:UPDATE/CREATE/DELETE (roles/)
   
   DS-SECURITY-KEY:CREATE/UPDATE/DELETE (deliveryservices/{xmlID}/urisignkeys$,
     deliveryservices/sslkeys/add$,
     deliveryservices/xmlId/{xmlid}/sslkeys$,
     deliveryservices/sslkeys/generate/,
     deliveryservices/xmlId/{name}/urlkeys/copyFromXmlId/{copy-name}/,
     deliveryservices/xmlId/{name}/urlkeys/generate/,
     deliveryservices/xmlId/{name}/urlkeys/,
     deliveryservices/{id}/urlkeys/,
     deliveryservices/sslkeys/generate/letsencrypt/)
     letsencrypt/autorenew/)
   
   PLUGIN:READ (plugins/)
   ```
   <!-- Describe how the bug happens -->
   
   
   ## Expected behavior:
   At least the admin user should have all of these permissions, potentially other users too.
   <!-- Describe what the behavior would be without the bug -->
   
   
   ## Steps to reproduce:
   Run the db setup and look in the `role_capability` table and see that these permissions do not exist in there.
   <!-- If the current behavior is a bug, please provide the *STEPS TO REPRODUCE* and
   include the applicable TC version.
   -->
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [trafficcontrol] ocket8888 commented on issue #6609: Missing Permissions in DB seed/migration

Posted by GitBox <gi...@apache.org>.
ocket8888 commented on issue #6609:
URL: https://github.com/apache/trafficcontrol/issues/6609#issuecomment-1058396384


   * `CDNI-CAPACITY:UPDATE`
   * `CDNI-CAPACITY:ADMIN`
   * `CDNI-CAPACITY:READ`
   
   This didn't already exist when Permissions were updated. Since priv_level still exists and the routes requiring these Permissions ostensibly have a required priv_level that was intentionally set, we _can_ seed these, but that's not strictly necessary, IMO, since that's not something we'd do for a new concept like this once priv_level is removed.
   
   Also I'd vote we rename `CDNI-CAPACITY:ADMIN` to something like `CDNI-CAPACITY:APPROVE-CONFIG` to better reflect what it actually does.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [trafficcontrol] shamrickus commented on issue #6609: Missing Permissions in DB seed/migration

Posted by GitBox <gi...@apache.org>.
shamrickus commented on issue #6609:
URL: https://github.com/apache/trafficcontrol/issues/6609#issuecomment-1059183286


   Edited the issue to reflect. Also removed ssl-key-experation since it's the same story.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org