opencloud
opencloud copied to clipboard
multi-tenancy: Space admin can still list spaces from all tenants
Describe the bug
In a multi-tenant setup, any user with the role SpaceAdmin can list all space from all tenants
Steps to reproduce
- deploy a multi-tenant enabled OpenCloud (e.g. using https://github.com/opencloud-eu/opencloud/pull/1637)
- assign one user from each tenant the role
SpaceAdminusing keycloak - As a SpaceAdmin of the first tenant create a new Space (no need to assign any users to it)
- As the SpaceAdmin of the second tenant open the
Admin Settings->Spacespage. - The Space created for tenant one is listed.
Expected behavior
Only Space from the same tenant are visible to a SpaceAdmin
I'd consider this a Prio 2 issue for now as multi-tenancy is not yet a production feature.