Jira (PUP-3855) auth.conf no longer restricting based on environment

Title: Message Title

Ruth Linehan created an issue

PUP-3855

Our documentation (https://docs.puppetlabs.com/guides/rest_auth_conf.html#environment) states that in auth.conf you can specify an environment or a list of environments allowed for an ACL.

With the move of environment from the first path fragment to a query parameter, this seems to no longer work.

Test:
change auth.conf to have the following block:

path ~ ^/node/([^/]+)$

method find

environment production

auth any

allow *

Start the puppet master. Make a request against the node endpoint with environment production:

$ curl -k https://localhost:8140/production/node/foo

{"document_type":"Node","data":{"name":"foo","environment":"production"}}

The request with environment production is authorized and returns information.

Create a test directory in the environmentpath.

Make a request with this environment. It will fail because the environment is not allowed.

$ curl -k https://localhost:8140/test/node/foo

Forbidden request: localhost(127.0.0.1) access to /node/foo [find] at :125

Trying this on master, with the following equivalent ACL

path ~ ^/node/([^/]+)$

method find

environment production

auth any

allow *

which should allow a request with environment=production, I get:

$ curl -k https://localhost:8140/puppet/v3/node/foo?environment=production

Forbidden request: localhost(127.0.0.1) access to /puppet/v3/node/foo [find] at :129

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Reply via email to