product-is
product-is copied to clipboard
[Migration] Add a fine grained permission for CORS Config Management APIs
Describe the issue:
In order to function CORS management rest APIs in IS-5.11.0, it requires at least /permission/admin/manage
permissions, due to the following issue.
- The permissions populated in the permission tree: (/permission/admin/manage/cors/origin/view)
https://github.com/wso2/carbon-identity-framework/blame/master/components/cors-mgt/org.wso2.carbon.identity.cors.mgt.core/src/main/resources/META-INF/component.xml#L19-L31
- But the permissions required for API access control: (/permission/admin/manage/identity/cors/origins/view)
https://github.com/wso2/carbon-identity-framework/blob/6c3c2f6b57d736ab393af0aa9dd17b1c142807cf/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2#L2534-L2541
-
internal_cors_origins_view
scope-permission mapping uses /permission/admin/manage/identity/cors/origins/view permission https://github.com/wso2-extensions/identity-inbound-auth-oauth/blob/4b75ae155a144a90796fffdcbe9d181d4a141a86/features/org.wso2.carbon.identity.oauth.server.feature/resources/oauth-scope-bindings.xml#L884-L887
Nonworking cases due to the issue mentioned above:
- In order to view application mgt pannel of the console, a user needs to have at least the following scope-related permissions https://github.com/wso2/carbon-identity-framework/blob/2327dd5f32d9627bbd16dd8b0b03a5b07a185c8a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json#L686-L693 Since the cors config, API-related permission string in the permission tree doesn't map to the permission used in oauth-scope-binding, the scope is not returning correctly.
- The user who has only CORS permission assigned through the permission tree, will not be able to access CORS REST APIs
So, in order to function the CORS config APIs, the user should at least have /permission/admin/manage
permission.
With change: https://github.com/wso2/carbon-identity-framework/pull/4124 , we are correcting the permissions added into the permission tree.
It is required to mention this configuration change in the 5.12.0 migration docs. Now fined grained permission is enough to access the CORS config APIs.
https://github.com/wso2/carbon-identity-framework/pull/4124 is merged. But keeping the issue open for the migration.
Addressed in https://github.com/wso2/docs-is/pull/3232