hashicorp / hashicorp/nomad

UI: inconsistent authentication when viewing logs

Open
#18,121 1 comment 2 reactions 0 assignees View on GitHub
theme/auth theme/ui type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Nomad version
Clients and servers are both running 1.6.0

### Operating system and Environment details
Clients and servers are running Ubuntu 22.04

### Issue

Users who have the `read-logs` capability assigned for a specific namespace are able to view the logs for an allocation when clicking "View Logs" from the overall job status page (/ui/jobs/jobname@namespace) but are unable to view the logs when going clicking "Logs" from the allocations page (/ui/allocations/allocation/task).

Admins who have permission on the whole cluster, rather than a specific namespace, do not run into this issue.

### Reproduction steps

Apply the following ACL policy:
```
namespace "project" {
policy = "read"

capabilities = [
"alloc-lifecycle",
"read-logs",
]

variables {
path "*" {
capabilities = [
"destroy",
"read",
"write",
]
}
}
}
```

Ensure there is a task running, generate a test token for the above policy, and then:
* From the "Jobs" page (/ui/jobs?namespace=project) select a job
* From the job details page (/ui/jobs/jobname@project) select "View Logs" on a running task
* Note that you can see current logs
* Now click the "Go to Task Page" at the top right of logs pane, this will take you to the tasks allocation page (/ui/allocations/allocation/task)
* Click the "Logs" button at the top
* Note that you get the "Not Authorized" page

#### Expected Result

The user is able to view the tasks logs.

#### Actual Result

The user gets a not authorized response.

### Nomad UI logs

When viewing the developer tools console we do see an unrecoverable error being logged.

```
description: undefined
errors: Array(1)
0:
detail: "Permission denied"
status: "403"
title: "The backend responded with an error"
message: "Ember Data Request GET /v1/node/ returned a 403\nPayload (text/xml)\nPermission denied"
```

Reviewing the network pane I can see the 403 requests to the node endpoints.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue with the namespace-scoped read-logs policy, comparing View Logs from /ui/jobs/jobname@namespace with Logs from /ui/allocations/allocation/task. Start by tracing the allocation-page request that reaches /v1/node/ and returns 403, then compare its authentication context with the working job-details flow. Done means both paths display task logs for the scoped token without an unauthorized response.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, authentication, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.