hanicz opened a new pull request, #1344: URL: https://github.com/apache/knox/pull/1344
…a without a caller authorization check [KNOX-3411](https://issues.apache.org/jira/browse/KNOX-3411) - KnoxToken getUserTokens returns every user's token metadata without a caller authorization check ## What changes were proposed in this pull request? - Bug: any authenticated user could read any/all users' token metadata via ?userName=, ?createdBy=, ?userNameOrCreatedBy=, or ?allTokens=true. No caller check. - Fix: in getUserTokens, admins (canSeeAllTokens) get everything; ordinary callers may only query their own tokens, else 403 + audit log. ## How was this patch tested? Unit tests. Locally tested by adding KNOXTOKEN to sandbox topology ``` curl -vku admin:admin-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M"; curl -vku tom:tom-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M"; curl -vku guest:guest-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M"; curl -vk -u guest:guest-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?userNameOrCreatedBy=admin"; curl -vk -u tom:tom-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?userName=guest"; curl -vk -u guest:guest-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?userNameOrCreatedBy=tom"; curl -vk -u guest:guest-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?allTokens=true"; curl -vk -u tom:tom-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?allTokens=true"; curl -vk -u admin:admin-password -X "GET" "https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?allTokens=true"; ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
