You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "Yicong-Huang (via GitHub)" <gi...@apache.org> on 2026/05/04 06:41:01 UTC
[I] Microservices do not enforce @RolesAllowed; workflow-compiling-service has no auth filter at all [texera]
Yicong-Huang opened a new issue, #4904:
URL: https://github.com/apache/texera/issues/4904
### What happened?
`@RolesAllowed` annotations on microservice resources are **not enforced** because none of the microservices register Jersey's `RolesAllowedDynamicFeature`. The annotations are decorative — anyone with a valid JWT can hit endpoints labeled `@RolesAllowed(Array("ADMIN"))`, regardless of the user's role.
`workflow-compiling-service` is worse: it registers neither `JwtAuthFilter` nor `RolesAllowedDynamicFeature`, so its `@RolesAllowed` endpoint runs without any authentication or authorization at all.
`amber` correctly registers `RolesAllowedDynamicFeature` (`amber/.../web/TexeraWebApplication.scala:142` and `amber/.../web/ComputingUnitMaster.scala:172`), so its annotations work as intended.
| Service | `JwtAuthFilter` | `RolesAllowedDynamicFeature` | uses `@RolesAllowed`? |
|---|---|---|---|
| access-control-service | yes | **no** | no |
| config-service | yes | **no** | yes (2 places) |
| file-service | yes | **no** | no |
| computing-unit-managing-service | yes | **no** | yes (10+ places) |
| workflow-compiling-service | **no** | **no** | yes (1 place) |
| amber (`TexeraWebApplication`, `ComputingUnitMaster`) | yes | yes | yes |
Concrete decorative annotations:
- `config-service/.../resource/ConfigResource.scala:32, 66` — `@RolesAllowed(Array("REGULAR", "ADMIN"))`
- `computing-unit-managing-service/.../resource/ComputingUnitManagingResource.scala:252, 262, 276, 491, 594, 642, 682, 736, 751` — `@RolesAllowed(Array("REGULAR", "ADMIN"))`
- `computing-unit-managing-service/.../resource/ComputingUnitAccessResource.scala:104` — same
- `workflow-compiling-service/.../resource/WorkflowCompilationResource.scala:59` — same (and the request is unauthenticated to begin with)
### How to reproduce?
1. Issue a JWT for a user whose role is below the one a `@RolesAllowed` annotation requires (e.g. role `INACTIVE` against `@RolesAllowed(Array("REGULAR", "ADMIN"))`).
2. `curl -H "Authorization: Bearer <that-token>" http://localhost:<port>/api/<annotated-endpoint>` against `config-service` or `computing-unit-managing-service`.
3. Observe: the request succeeds with `200`. The role check is silently skipped.
4. For `workflow-compiling-service`, omit the token entirely: any request reaches the resource method. No `JwtAuthFilter` runs because the service never registers it.
### Branch
main
### Commit Hash (Optional)
786a920796
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang closed issue #4904: Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all
URL: https://github.com/apache/texera/issues/4904
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on issue #4904:
URL: https://github.com/apache/texera/issues/4904#issuecomment-4368840416
@chenlica please check this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang closed issue #4904: Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all
URL: https://github.com/apache/texera/issues/4904
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on issue #4904:
URL: https://github.com/apache/texera/issues/4904#issuecomment-4641014627
still have more work to do
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Ma77Ball (via GitHub)" <gi...@apache.org>.
Ma77Ball commented on issue #4904:
URL: https://github.com/apache/texera/issues/4904#issuecomment-4436857103
/take
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on issue #4904:
URL: https://github.com/apache/texera/issues/4904#issuecomment-4885370912
Fixed. Enforcement re-landed in #5199 (all five microservices now register `JwtAuthFilter` + `RolesAllowedDynamicFeature` via the shared `AuthFeatures.register`), file-service was covered in #5198, and #5743 added `RoleAnnotationEnforcer`, which fails service startup if any HTTP resource method lacks `@RolesAllowed`/`@PermitAll`/`@DenyAll` — so annotations can no longer silently be decorative. workflow-compiling-service now requires a JWT as well. Follow-up (out of scope here): notebook-migration-service registers the auth stack but doesn't run `RoleAnnotationEnforcer` yet.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on issue #4904:
URL: https://github.com/apache/texera/issues/4904#issuecomment-4527598766
@Ma77Ball please make sure to reopen the issue when revert lands.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang closed issue #4904: Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all
URL: https://github.com/apache/texera/issues/4904
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org