[
https://issues.apache.org/jira/browse/UNOMI-1031?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18136459#comment-18136459
]
Serge Huber commented on UNOMI-1031:
------------------------------------
Fixed by https://github.com/apache/unomi/pull/942 (merged as 684f6c882).
Restricted event types are now refused when a tenant has no authorizedIPs, with
a warning logged once per tenant. Callers using the tenant private key or
administrator credentials are not IP-checked. Documented in the multi-tenancy
page and the 3.0 to 4.0 migration guide. Full integration test suites passed on
Elasticsearch and OpenSearch.
> Fail closed on an empty authorized-IP set for restricted event types
> --------------------------------------------------------------------
>
> Key: UNOMI-1031
> URL: https://issues.apache.org/jira/browse/UNOMI-1031
> Project: Apache Unomi
> Issue Type: Improvement
> Components: unomi(-core)
> Affects Versions: unomi-4.0.0
> Reporter: Serge Huber
> Assignee: Serge Huber
> Priority: Major
> Fix For: unomi-4.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> _In short_
> A tenant with an empty authorized-IP list, which is the default for a new
> tenant, accepts restricted event types such as {{updateProperties}} from any
> public caller. They should be refused until the tenant lists the IPs allowed
> to send them.
> _Details_
> * Restricted types are {{sessionCreated}}, {{sessionReassigned}},
> {{profileUpdated}}, {{ruleFired}} and {{updateProperties}}, plus any listed
> in the tenant's {{restrictedEventTypes}}. An empty {{authorizedIPs}} is
> currently treated as "no restriction".
> * In 3.0 these events were refused unless they came from a configured
> third-party server. 4.0 should keep that default.
> * Callers using the tenant private key or administrator credentials can
> already change any profile, so they are not IP-checked.
> _Fix and test_
> Refuse restricted types when {{authorizedIPs}} is empty, and document it in
> the manual. Unit tests in {{EventServiceImplTest}}, plus a
> {{ContextServletIT}} test: refused with no IPs, accepted once the caller IP
> is listed.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
