influxdata / influxdata/influxdb
UI allows user with all-access token to create a telegraf configuration when the user actually needs to be owner
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
With influxdb 2.0.4, I created the admin account with the `influx` command and then create a new user with `influx user create ...` and then created an all-access token for the user with:
```
$ influx auth create --skip-verify --read-buckets --read-checks --read-dashboards --read-dbrps --read-notificationEndpoints --read-notificationRules --read-orgs --read-tasks --read-telegrafs --read-user --write-buckets --write-checks --write-dashboards --write-dbrps --write-notificationEndpoints --write-notificationRules --write-orgs --write-tasks --write-telegrafs --write-user --user -o -d "'s Token"
```
Then I logged into the UI and tried to create a telegraf configuration, which partially failed since it couldn't create a token for it. This is the log message:
```
influxd[26561]: ts=2021-03-26T16:48:20.478454Z lvl=error msg="api error encountered" log_id=0T7g0gC0000 error="write:orgs//authorizations is unauthorized"
```
Looking at `influx auth list` I see why:
```
$ influx auth list --skip-verify
ID Description Token User Name User ID Permissions
... admin's Token ... admin ... [read:authorizations write:authorizations read:buckets...]
... user's Token ... user ... [read:orgs/.../buckets ...]
```
(ie, the 'user' doesn't have read/write on authorizations).
__Expected behavior:__
I suspect not being able to create a token is intended, but the UI should handle this more gracefully and not allow this user to create a telegraf configuration.
__Actual behavior:__
As it is, the user can partially create one (a board is created and a config is created, but it lacks a token), but gets two red pop-ups ('Failed to save configurations' and 'Could not create dashboards for one or more plugins') when clicking 'Create and Verify'.
__Environment info:__
* System info: Linux 4.4.0-206-generic x86_64
* InfluxDB version: InfluxDB 2.0.4 (git: 4e7a59bb9a) build_date: 2021-02-08T17:47:02Z
* Other relevant environment details: Ubuntu 18.04
__Config:__
N/A
__Logs:__
```
influxd[26561]: ts=2021-03-26T16:48:20.478454Z lvl=error msg="api error encountered" log_id=0T7g0gC0000 error="write:orgs//authorizations is unauthorized"
```
__Performance:__
N/A
Contributor guide
Research direction
Start by reproducing the Create and Verify flow in the UI with an all-access token that lacks authorization permissions, then trace the request that creates the Telegraf configuration and token. Done means the UI prevents the unsupported action before partially creating resources and shows a clear permission-related message.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100