provectus/kafka-ui

[RBAC] Deny access to user with no permissions

Open

#2,946 opened on 2022年11月16日

GitHub で見る
 (8 comments) (1 reaction) (0 assignees)Java (7,799 stars) (977 forks)batch import
area/rbacgood first issuescope/frontendstatus/acceptedtype/enhancement

説明

Might be taken into work after the #753

Which version of the app are you running?

5900f8e

Is your proposal related to a problem?

User, that can pass the authentication, gets to the page with no clusters on it. Which is a bit strange.

Describe the solution you'd like

User with no permissions on any cluster, should be declined access instead.

Describe alternatives you've considered

Separate page with "No permissions provided for the user! Contact your administrator for support" message

Additional context

コントリビューターガイド

技術スタック
javaspringreact
領域
authenticationauthorizationfull stack
Issue 種別
feature
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
3
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
1-2 days
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
blocked
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
clear
前提条件
Knowledge of RBAC conceptsFamiliarity with Spring Security
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
40
調査方針
First, investigate the existing RBAC implementation in the codebase, particularly how permissions are checked after authentication. The commit 5900f8e may be relevant. Also, review issue #753 to understand the current state of RBAC. The desired behavior is to deny access to users with no permissions. Look at the frontend routing and backend controllers to implement a check that redirects or returns a 403 error.
[RBAC] Deny access to user with no permissions · provectus/kafka-ui#2946 | Good First Issue