hashicorp / hashicorp/nomad

ACL policies not correctly being applied after OIDC token expiry and re-login, and UI not showing correctly.

Open
#18,950 4 comments 0 reactions 0 assignees View on GitHub
stage/needs-investigation theme/acl theme/ui type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Nomad version
Output from `nomad version`

```
Nomad v1.6.2
BuildDate 2023-09-13T16:47:25Z
Revision 73e372ad94033db2ceaf53468b270a31544c23fd
```

### Issue
When using OIDC token (possibly not limited to OIDC tokens) and token expires, and you are logged in again, the ACL policies appear to not be applied correctly, resulting in namespaces not being visible, regions not being visible, jobs not being visible (except for what a possibly anonymous ACL would allow, but even then, the information is still a lot less then it should be, as overall the UI just looks empty)

### Reproduction steps

- OIDC token expired
- login
- UI looks like hiding a lot of information (see Actual result)

#### Expected Result
- see all namespaces/jobs/region information.

![image](https://github.com/hashicorp/nomad/assets/19852218/590d6871-270f-465e-835e-090cbfddf0a5)

#### Actual Result

![image](https://github.com/hashicorp/nomad/assets/19852218/a4d64a93-e53a-42fc-980a-bc5f9f1d40aa)

- **regions** are missing
- **jobs** are missing
- **vault-UI** link is missing (_nomad.hcl -> ui.vault.ui_url_)
- **consul-UI** link is missing (_nomad.hcl -> ui.consul.ui_url_)
- **UI Label** is missing (_nomad.hcl -> ui.label.text_)
- **Sign-in link is showing**, but should be showing "**profile**" with **Authorization/Sign out** options.

- **note** _all info shows again after doing F5/page refresh, and yes it works, but ideally shouldn't be needed._

Contributor guide

No contributing guide indexed for this repository

Research direction

The report names no source files or tests. First reproduce the expired OIDC token and re-login flow, then trace how authorization state reaches the UI; done means namespaces, regions, jobs, configured Vault and Consul links, the UI label, and the profile controls appear without a page refresh.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, authorization, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.