OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
5.2k stars 821 forks source link

[Segragation by Org] User cannot share with other organizations under certain condition #7624

Closed Lhorus6 closed 3 days ago

Lhorus6 commented 1 week ago

Description

After extensive testing, it appears that a user who is not a member of the platform organization cannot share entity with other organizations.

Environment

OCTI 6.2.1

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create Org A and Org B
  2. Set Org B as platform organization
  3. Create User A part of Org A and with the capability "Restrict organization access" only (you'll also get "access" and "create/update knowledge" by default, which is normal)
  4. Login with User A
  5. Create a report
  6. Try sharing this report with other organizations -> You don't have the button to do so

Additional information

If you now put User A in the platform organization (Org B), you can now share entities with other organization using User A.

This may not be a bug, but an expected behavior. Let me know if this is the case

SamuelHassine commented 1 week ago

I confirm that this is not normal. A user with the proper permission should be able to share its own content to other organizations.

SamuelHassine commented 1 week ago

That being said, it is like this since the beginning of organization sharing feature, likely a "bug/feature" :)

romain-filigran commented 5 days ago

@Jipegien : What's your opinion on this ?

Jipegien commented 5 days ago

The feature has been initially designed to give the capability to share to other orga to only users of the main organization. Now, we have use cases where other Organizations' users would like to give access to their work to other Organizations (without going through the "Admin" Organization). And later probably the use case of Access Request that will need to be accepted by an Organization having created the data.

So definitely a feature, not a bug.

It may not be a big one, as we have already a defined Capability.

Lhorus6 commented 5 days ago

@Jipegien So it's something that needs to be prioritized in a roadmap, I guess?