search

IUSCA / SQAN

Scalable Quality Assurance for Neuroimaging - (SQAN): A full-stack system solution for extracting, translating, and logging (ETL) + web portal-based quality-control verification of DICOM-formatted medical imaging data/metadata.
https://sqan.sca.iu.edu/
Other
8 stars 3 forks source link

SQAN: Add sudo/become user feature #152

Closed agopu closed 4 years ago

youngmd commented 4 years ago

Added "spoof" route to the user API controller. Authenticated users with the "god" role can utilize this route to temporarily become any other user. Implemented in vue interface, works as expected. Logging out and back in reverts to normal user.

youngmd commented 4 years ago

After discussing with Arvind we agreed that because admin users can assign roles it created a security gap where an admin user could self-promote themselves to the god role then sudo in as another user. Solution is to limit user editing/deletion to the god role only. This also necessitated updating the bootstrap script in /bin that creates the initial 'admin' user to assign the god role.