influxdata / influxdata/influxdb

UI allows user with all-access token to create a telegraf configuration when the user actually needs to be owner

Open
#21,081 0 comments 0 reactions 0 assignees View on GitHub
area/2.x area/auth team/ui
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__

With influxdb 2.0.4, I created the admin account with the `influx` command and then create a new user with `influx user create ...` and then created an all-access token for the user with:

```
$ influx auth create --skip-verify --read-buckets --read-checks --read-dashboards --read-dbrps --read-notificationEndpoints --read-notificationRules --read-orgs --read-tasks --read-telegrafs --read-user --write-buckets --write-checks --write-dashboards --write-dbrps --write-notificationEndpoints --write-notificationRules --write-orgs --write-tasks --write-telegrafs --write-user --user -o -d "'s Token"
```

Then I logged into the UI and tried to create a telegraf configuration, which partially failed since it couldn't create a token for it. This is the log message:
```
influxd[26561]: ts=2021-03-26T16:48:20.478454Z lvl=error msg="api error encountered" log_id=0T7g0gC0000 error="write:orgs//authorizations is unauthorized"
```
Looking at `influx auth list` I see why:
```
$ influx auth list --skip-verify
ID Description Token User Name User ID Permissions
... admin's Token ... admin ... [read:authorizations write:authorizations read:buckets...]
... user's Token ... user ... [read:orgs/.../buckets ...]
```
(ie, the 'user' doesn't have read/write on authorizations).

__Expected behavior:__
I suspect not being able to create a token is intended, but the UI should handle this more gracefully and not allow this user to create a telegraf configuration.

__Actual behavior:__
As it is, the user can partially create one (a board is created and a config is created, but it lacks a token), but gets two red pop-ups ('Failed to save configurations' and 'Could not create dashboards for one or more plugins') when clicking 'Create and Verify'.

__Environment info:__
* System info: Linux 4.4.0-206-generic x86_64
* InfluxDB version: InfluxDB 2.0.4 (git: 4e7a59bb9a) build_date: 2021-02-08T17:47:02Z
* Other relevant environment details: Ubuntu 18.04

__Config:__
N/A

__Logs:__
```
influxd[26561]: ts=2021-03-26T16:48:20.478454Z lvl=error msg="api error encountered" log_id=0T7g0gC0000 error="write:orgs//authorizations is unauthorized"
```

__Performance:__
N/A

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Create and Verify flow in the UI with an all-access token that lacks authorization permissions, then trace the request that creates the Telegraf configuration and token. Done means the UI prevents the unsupported action before partially creating resources and shows a clear permission-related message.

Written by the indexing model from the issue text.

Assessment

Domain
authorization, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.