Create job via API can fail due to authorization bug

#469

using the job import API, the request may fail due to authorization, with the audit log containing:

2011-11-09 09:22:00,095 - Evaluating Decision for: res<type:job,job:<removed>, group:test> \
  subject<Username:<removed> Group:api_token_group> action<create> \
  env<http://dtolabs.com/rundeck/env/project:null>: authorized: false: \
  No context matches subject or environment => REJECTED_NO_SUBJECT_OR_ENV_FOUND \
  (0ms)No context matches subject or environment => REJECTED_NO_SUBJECT_OR_ENV_FOUND

specifically, the env<http://dtolabs.com/rundeck/env/project:null> is incorrect

Reported by Greg Schueler · November 9th, 2011 @ 09:50 AM

Activity

Greg Schueler
(from [2661e7797aebb9274d5deb77b936650f075bb997]) Add create action to job auth for default apitoken policy [#469] https://github.com/dtolabs/rundeck/commit/2661e7797aebb9274d5deb77b...

November 9th, 2011 @ 12:13 PM
Greg Schueler
(from [41b8a3fb03354953fa41f96b72294a7fbd55bb99]) Use job.project not session.project for auth check

Fixes some "null" project auth checks when using token based
API requests

[#469] https://github.com/dtolabs/rundeck/commit/41b8a3fb03354953fa41f96b7...

November 9th, 2011 @ 12:14 PM
Greg Schueler
(from [0d2c682c96e0048e72b8a0feb0004d59bc334024]) Add authorizeProjectResources for multiple resources

don't allow null project argument for authorize* methods
Fix getFrameworkNodeName to properly get rundeck base dir

[#469] https://github.com/dtolabs/rundeck/commit/0d2c682c96e0048e72b8a0feb...

November 9th, 2011 @ 12:14 PM
Greg Schueler
(from [6abb827a3947be716cb1ba6f952ddf6de510f823]) Use frameworkService authorizeProjectResources

don't use session for project value

[#469] https://github.com/dtolabs/rundeck/commit/6abb827a3947be716cb1ba6f9...

November 9th, 2011 @ 12:14 PM
Greg Schueler
(from [7b38b3e1bc99656927505787b71503a00664f1e4]) Use frameworkService for auth checks [#469] https://github.com/dtolabs/rundeck/commit/7b38b3e1bc99656927505787b...

November 9th, 2011 @ 12:14 PM
Greg Schueler
- State changed from new to needs_verification
November 9th, 2011 @ 12:47 PM
Greg Schueler
- State changed from needs_verification to resolved
tested with api tests using api token auth

November 9th, 2011 @ 12:50 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.