gabrielsroka / gabrielsroka.github.io

My website, including rockstar: Export Okta Users, Groups, etc. to CSV. Show SAML assertion.
https://gabrielsroka.github.io/
MIT License
92 stars 37 forks source link

Not all Export Users columns are selectable unless "Manage applications" for admin role is checked #36

Closed ctrang032 closed 2 years ago

ctrang032 commented 2 years ago

For custom admin roles, I can check every box except for Manage applications and Rockstar only shows half of the available user attributes to be exported. As soon as I enable Manage applications, this allows all columns to be selectable. image

My admin is able to view all user details, run API explorer to view all available attributes completely fine. However Export User columns are limited because their role does not have "Manage applications" available which I thought was odd.

There's nothing different about the user attributes, it includes custom/additional attributes from workday; it just looks like it gets cutoff. full view image

limited view image

Is this by design? I find it weird that enabling "Manage applications" will allow the rest of the columns to be available.

ctrang032 commented 2 years ago

a bit more detail, it gets cut off at attribute 44 out of 63

gabrielsroka commented 2 years ago

In order to call the API to see all the custom attributes, you need appropriate admin privs. This is not a bug, it's a limitation in the API.

ctrang032 commented 2 years ago

Oh that's interesting. So enabling Manage applications grants a bit more privileges for rockstar to able to list custom attributes for the export? Using API explorer, without Manage application, the admin is able to see all custom attributes, so it isn't an issue with the user viewing it, but moreso allowing rockstar to populate the available custom attributes columns to be exported under Export Users?

ctrang032 commented 2 years ago

Just checked Profile Editor, it is actually only custom attributes that are not listed to be available.

ctrang032 commented 2 years ago

actually, thinking the logic through this, that makes sense. Since custom attributes are attributes of applications. Without managing capabilities of the app, rockstar does not have the ability to pull that info.