Log the scopes an issuer's allowed_scopes strips from a token
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start by locating _filter_scopes and reading how it applies an issuer's allowed_scopes and how nearby logging includes the issuer and actor_id. Add debug-level logging for scopes dropped by the filter, then run the relevant tests for scope filtering and logging. Done when dropped scopes are logged with the issuer and request actor, without changing filtering behavior.
Written by the indexing model from the issue text.
Description
What
_filter_scopes silently drops any scope in a token that the issuer's allowed_scopes does not match. When the caller is then refused, the log has access.denied with "requires scope: X", but nothing records that X was in the token and was stripped.
Effect
A misconfigured allow-list looks the same in the logs as a user who was never granted the scope, and diagnosing it means decoding the user's token by hand. It becomes more likely once Entra ID app roles arrive in roles and pass through the same filter (#85).
Fix
Log the dropped scopes in _filter_scopes, with the issuer, at debug level so it costs nothing until an operator turns it on. Scope names are not sensitive, and the line carries the request's actor_id like any other.
- Dominant language
- Python
- Stars
- 0
- Forks
- 3
- Avg merge
- 23h
- Merged PRs (30d)
- 70
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ukaea/fds
-
Use registered media types for HDF5 and NetCDF, and stop claiming media_type must be IANA-registeredOpendocumentation metadata
Difficulty 2/5 1-3 hours Newbie friendliness 87/100
Maintainers usually reply within 1 day
-
Media typeOpen
Difficulty 1/5 Under an hour Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
fair-compliance metadata
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
fair-compliance metadata
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
Maintainers usually reply within 1 day
Similar issues
-
binding:python bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
The Browser tab fails with a Wayland error when Open Terminal runs from a Wayland desktop sessionOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
open-webui/open-terminal#210 ·
-
triage/confirmed
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
agentscope-ai/agentscope#3807 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
NousResearch/hermes-agent#150542 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 91/100
triton-inference-server/server#9069 ·
Maintainers usually reply within 1 day