Andrea Patricelli created SYNCOPE-2008:
------------------------------------------
Summary: Managed users and groups are returned into the
x-syncope-entitlements header on self request
Key: SYNCOPE-2008
URL: https://issues.apache.org/jira/browse/SYNCOPE-2008
Project: Syncope
Issue Type: Bug
Components: core
Affects Versions: 4.1.4
Reporter: Andrea Patricelli
Fix For: 4.1.5, 4.2.0
# Make some user manager of a user or group, e.g. bellini manager of
artDirector group
# invoke self api like this
{noformat}
curl -X 'GET' \
'https://syncope-vm.apache.org/syncope/rest/users/self' \
-H 'accept: */*' \
-H 'X-Syncope-Domain: Master' \
-H 'Authorization: Basic YmVsbGluaTpwYXNzd29yZA=='{noformat}
inside the x-syncope-entitlements are returned group and/or users the user is
manager of, for example
{noformat}
x-syncope-entitlements:
{"REALM_SEARCH":["/"],"GROUP_UPDATE":["/@GROUP@ece66293-8f31-4a84-8e8d-23da36e70846"],"USER_DELETE":["/@USER@823074dc-d280-436d-a7dd-07399fae48ec","/even@USER@1417acbe-cbf6-4277-9372-e75e04f97000"],"USER_LIST":["/"],"RELATIONSHIPTYPE_LIST":["/"],"ANYTYPE_LIST":["/"],"USER_UPDATE":["/@USER@823074dc-d280-436d-a7dd-07399fae48ec","/even@USER@1417acbe-cbf6-4277-9372-e75e04f97000"],"GROUP_READ":["/@GROUP@ece66293-8f31-4a84-8e8d-23da36e70846"],"GROUP_SEARCH":["/@GROUP@ece66293-8f31-4a84-8e8d-23da36e70846"],"ANYTYPE_READ":["/"],"USER_SEARCH":["/"],"USER_REQUEST_FORM_CLAIM":["/"],"ANYTYPECLASS_READ":["/"],"ANYTYPECLASS_LIST":["/"],"GROUP_DELETE":["/@GROUP@ece66293-8f31-4a84-8e8d-23da36e70846"],"USER_READ":["/"],"USER_REQUEST_FORM_SUBMIT":["/"],"USER_REQUEST_FORM_LIST":["/"]}
{noformat}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
