Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-2583

Support multiple run-as roles from CLI and HTTP clients

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Done
    • Affects Version/s: None
    • Fix Version/s: 8.0.0.CR1
    • Component/s: Management
    • Labels:
      None

      Description

      The "run-as" roles feature with RBAC will only allow multiple role declarations if the caller provides a ModelNode of type LIST. The CLI doesn't do that and clients using the HTTP interface (e.g. web console) cannot do that. This makes doing this largely unsupported except for things like unit tests that create custom clients.

      Fix is to do some more sophisticated parsing in RunAsRolesMapper.getOperationHeaderRoles(...).

      1) If the trimmed role-list string starts with [ and ends with ] try to use ModelNode.fromString to parse. Return result if no error.
      2) If not, or there is a parse error in 1), check for "," and use String.split(",")
      3) Just return the trimmed string in a ModelNode.

      Step 2 makes "," a kind of privileged char in role names. However, in the extremely remote chance users want to include "," in role names and still use this feature, the solution is to use proper DMR syntax for the roles header value, e.g.

      ["yuck,commas","Maintainer"]

      So, in the CLI:

      $ :read-resource

      {roles=["yuck,commas","Maintainer"]}

      An HTTP client like the console should use proper DMR syntax for the value of the operation-header-roles query parameter.

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  brian.stansberry Brian Stansberry
                  Reporter:
                  brian.stansberry Brian Stansberry
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  2 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: