DependencyTrack / DependencyTrack/dependency-track

Projects can only be read via. API as admin

Open
#5,781 6 comments 0 reactions 0 assignees View on GitHub
defect pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

I created an *Automation* user and added the *PORTFOLIO_MANAGEMENT* permission.
But this user is unable to read all projects like:

https://dtrack.example.com/api/v1/project?pageNumber=1&pageSize=25&excludeInactive=false&onlyRoot=true

-> Result: 5 of 79

As soon as I switch the API key to an *Administrator* and perform the exact same call:

-> Result: 25 of 79

### Steps to Reproduce

1. Have more projects as 25
2. Create an *Automation* api key with *PORTFOLIO_MANAGEMENT*
3. Create an *Admin* api key with all permissions
4. Compare the project search results.

### Expected Behavior

I expect that a user with *PORTFOLIO_MANAGEMENT* is able to read all projects.

### Dependency-Track Version

4.13.6

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.