hashicorp / hashicorp/nomad

acl: an ACL token can be created referencing the same policy multiple times

Open
#14,073 0 comments 0 reactions 0 assignees View on GitHub
theme/auth theme/core type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Nomad version
`Nomad v1.3.3 (428b2cd8014c48ee9eae23f02712b7219da16d30)`

### Operating system and Environment details
Tested locally on macOS using a development agent.

### Issue
A Nomad ACL token can be created referencing a policy multiple times with the array never being deduplicated. This results in the duplicate policies being shown via the CLI and API and means the internal resolve token functions have extra work than is necessary.

### Reproduction steps
1. Run a development agent using the following config snippet to ensure ACLs are enabled:
```
acl {
enabled = true
}
```

2. Bootstrap the ACL system via the `nomad acl boostrap` command.

3. Create an ACL policy using the example policy below via the `nomad acl policy apply -token= test `:
```
node {
policy = "read"
}
```

4. Create an ACL token referencing the created policy multiple times by running `nomad acl token create -policy=test -policy=test`

#### Expected Result
The policy name array is deduplicated before being written to state.

#### Actual Result
The token create output shows the policy link duplicated:
```
Accessor ID =
Secret ID =
Name =
Type = client
Global = false
Policies = [test test]
Create Time = 2022-08-10 07:18:23.87098 +0000 UTC
Create Index = 20
Modify Index = 20
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the `nomad acl token create -policy=test -policy=test` entry point and trace the token creation path, including the internal resolve token functions mentioned in the issue. Done means repeated policy names are deduplicated before state is written and no longer appear duplicated in CLI or API output.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authorization, cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.