cloudfoundry / cloudfoundry/stratos
Failure to check required SSO auth permissions may result in a bad experiance
Open
Nobody has claimed this yet.
bug
- Dominant language
- TypeScript
- Stars
- 267
- Forks
- 137
- Avg merge
- 5h 14m
- Merged PRs (30d)
- 77
Description
- With UAA SSO enable user has to check permisions to allow app to access certain features
- User can select a single feature and then continue, logging in successfully to stratos
- This means Stratos cannot access the information it may require, we don't have granular permissions checking on individual scopes
- Should we block user from accessing Stratos until they've checked them all? Should be find all permissions that the app needs (trim any not needed) and apply correct check when ui needs to use them?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named; start by tracing the UAA SSO login flow and how Stratos determines the permissions or scopes required by its features. Clarify whether login should be blocked or permissions checked per feature, then verify that users cannot reach functionality without the required permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- angular, typescript
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100