cloudfoundry / cloudfoundry/uaa-cli
UAA CLI not validating scopes
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 22
- Forks
- 14
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 11
Description
This is similar PR opened for UAAC at https://github.com/cloudfoundry/cf-uaac/issues/64
When creating a client using the latest build of UAA, the scopes are not validated. The UAA is creating the scope with any string we give rather than validating the scopes existence within UAA. Is it any limitation that UAA has to validate scopes?, as grant types are being validated by the CLI at the same time.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the UAA CLI entry point for creating a client and compare its scope handling with the grant-type validation mentioned in the issue and the linked UAAC issue. Determine whether the CLI or UAA owns scope validation; done means nonexistent scopes are rejected when creating a client, with behavior documented by a test if the project provides one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100