Roles cannot be empty

[nvoskuilen]

1) Login as admin and create a new role (name: UserManager) with only the "User Permissions" checked 2) Create a new user (Manager) and asign it the new (UserManager) role 3) Login with the new (Manager) user and try to create a new user

On save it will show an error "Roles cannot be empty"

[emonney]

This is because you need assignRoles permission too to create new users. Latest commit https://github.com/emonney/QuickApp/commit/f916303a75f553e202be66a5265797fefd03029a addresses this by not showing the "New User" UI when the current user doesn't have the assignRoles permission

[nvoskuilen]

Thanks for your message.

After assigning the "Assign Role" permission to the (UserManager) the "Roles" dropdown shows up but is empty when create/edit a user using the (Manager). This also results in the "Roles cannot be empty" message. I noticed too that sometimes there actually is one role in the Role list, and it looks like its the second role in the role list which comes after the role where the (Manager) is assigned to, this can be reproduced by repeatedly clicking create user and closing the modal while checking the role list every cycle.

So one must also assign the "View Role" permission to the UserManager-Role, but then the Manager could elevate itself to Administrator level, and/or create new users with Administrator powers.

f916303 breakes the creation of any users right now:

Save Error The below errors occured whilst saving your changes: Access Denied! Forbidden Http failure response for http://localhost:55127/api/account/users: 403 Forbidden

I think it is the addition of the decorator in the AccountController "[Authorize(AuthPolicies.AssignRolesPolicy)]"

[emonney]

• The "Access Denied" error have been fixed in the newest commit.
• I couldn't reproduce this:

  I noticed too that sometimes there actually is one role in the Role list

Please check if you can reproduce this behavior you described in the latest commit

• Permission Authorization has now been reorganized. The description below captures your scenario: In order to create new users the creating user must have the following permissions. ViewUser, ManageUser and AssignRoles. If the creating user does not have access to the ViewRoles permission, he can only create users with roles he already belongs to. For any other application specific scenario, you can implement another AuthorizationHandler for the AssignRolesAuthorizationRequirement that should handle your unique scenario.

Let me know your take on this and how it can further be improved.