Serge Huber created UNOMI-978:
---------------------------------
Summary: Gate cross-profile merge and systemProperties writes on a
trusted caller
Key: UNOMI-978
URL: https://issues.apache.org/jira/browse/UNOMI-978
Project: Apache Unomi
Issue Type: Improvement
Components: unomi(-core)
Affects Versions: unomi-3.1.0
Reporter: Serge Huber
Assignee: Serge Huber
Fix For: unomi-3.1.0
h2. Current behaviour
Two built-in actions act on identity rather than on the calling profile's own
data:
* {{MergeProfilesOnPropertyAction}} merges the current profile into another
profile selected by a
property value;
* {{UpdatePropertiesAction}} can write {{systemProperties}}, which is where
trust-bearing state such
as merge and identity markers is kept.
Both are reachable from a rule triggered by a public event, so neither was
confined to a caller that
had been authenticated as entitled to the target identity.
h2. Change
* Cross-profile merge and {{systemProperties}} writes require a trusted caller,
behind a single
{{isTrustedIdentityCaller()}} seam.
* A refused attempt is logged through the shared
{{org.apache.unomi.api.utils.LogSanitizer}}, so a
request-derived value cannot forge log lines.
* The login sample is rewritten to demonstrate the trusted server-side pattern:
the browser posts to
the operator's own servlet, which holds the tenant private key, rather than
asking the visitor's
browser to assert an identity. It ships in 3.1.
h2. Compatibility
Self-property writes and same-profile merges are unchanged. A server-side
integration holding the
tenant private key keeps both capabilities. Rules that relied on a public event
performing a
cross-profile merge must move that step behind a trusted caller — see the
rewritten sample.
h2. Tests
* {{UpdatePropertiesActionTest}}, {{MergeProfilesOnPropertyActionTest}} —
baseplugin 50/50.
* {{LoginServletTest}} (23) for the rewritten sample.
* Four action tests in {{ContextServletIT}}, plus {{ProfileMergeIT}} and
{{PropertiesUpdateActionIT}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
