Open ichasco-heytrade opened 2 years ago
I have seen that in the CLI works with this:
"id=${module.mongodb-dev.target_id};actions=authorize-session",
"id=*;type=target;actions=list",
I can list and I can authorize a session, but with desktop application I get a 403 :(
Hi @ichasco-heytrade, are you still experiencing this issue in the latest Boundary version (currently 0.7.6) and Boundary desktop version (1.4.2)?
@PPacent : I have a similar problem and this is blocking us from having a great customer experience (Boundary Desktop is any day more friendly for users rather than using CLI. FYI @randallmorey Reference : https://github.com/hashicorp/boundary/issues/1495 Boundary Version : 0.10.3 Boundary Desktop Version : 1.4.5
I am also running into this issue on Boundary 0.11.0
.
I'm trying to grant find-grained access to a specific target with a grant of
id=ttcp_lmhDHjOLmR;actions=read,authorize-session
This one does not work, even though I would assume that it should after reading the documentation on https://www.boundaryproject.io/docs/concepts/security/permissions/resource-table.
I am able to get Boundary to function if I modify the grant to this:
id=ttcp_lmhDHjOLmR;actions=authorize-session
id=ttcp_lmhDHjOLmR;type=*;actions=read
I do not understand why I have to add type=*
when I haven't had to do so for any other resource in Boundary, it seems like a bug to me (or just a bad implementation)
@randallmorey @BrandonIngalls @PPacent : On checking the logs, I found out that the forbidden error is coming due to missing session permission when I use specific target permission _id=ttcp_ziWqhSoHjS;actions=read,authorize-session
_
{"id":"qGMXmB65hy","source":"https://hashicorp.com/boundary/boundary-controller-6b7448b78d-sj7z4/controller","specversion":"1.0","type":"observation","data":{"latency-ms":176.356111,"request_info":{"id":"gtraceid_iKud8zifLKLP6QgfkacV","method":"POST","path":"/v1/targets/ttcp_ziWqhSoHjS:authorize-session","public_id":"at_cOvYlRE2Zw","client_ip":"10.151.236.67"},"start":"2022-10-11T21:31:25.603951601Z","status":200,"stop":"2022-10-11T21:31:25.780307812Z","version":"v0.1"},"datacontentype":"application/cloudevents","time":"2022-10-11T21:31:25.780338212Z"}
{"id":"tNRtx3Zxsv","source":"https://hashicorp.com/boundary/boundary-controller-6b7448b78d-sj7z4/controller","specversion":"1.0","type":"observation","data":{"latency-ms":0.084801,"request_info":{"id":"gtraceid_uSzxFKvD5DDNDuLDDMg9","method":"OPTIONS","path":"/v1/sessions/s_xpEGNWkWlg","client_ip":"10.151.236.37"},"start":"2022-10-11T21:31:25.816005779Z","status":204,"stop":"2022-10-11T21:31:25.81609058Z","version":"v0.1"},"datacontentype":"application/cloudevents","time":"2022-10-11T21:31:25.816101981Z"}
{"id":"tQv6WjtQyU","source":"https://hashicorp.com/boundary/boundary-controller-6b7448b78d-sj7z4/controller","specversion":"1.0","type":"observation","data":{"latency-ms":66.39417,"request_info":{"id":"gtraceid_QSyJffYtPPpMurTqDyAK","method":"GET","path":"/v1/sessions/s_xpEGNWkWlg","public_id":"at_cOvYlRE2Zw","client_ip":"10.151.236.37"},"start":"2022-10-11T21:31:25.822543965Z","status":403,"stop":"2022-10-11T21:31:25.888938235Z","version":"v0.1"},"datacontentype":"application/cloudevents","time":"2022-10-11T21:31:25.888978035Z"}
So, I added below permission which solved the issue for me:
"id=*;type=session;actions=read:self,cancel:self"
I'm facing an issue very similar to what's explained here. I can see the targets from the Desktop client, but not from the Web UI. The role grant that I assigned are similar to what @BrandonIngalls mentioned in the above comment:
"id=${boundary_target.target.id};actions=authorize-session,read",
"id=${boundary_target.target.id};type=*;actions=read",
"id=*;type=session;actions=read:self,cancel:self",
"type=scope;actions=list"
Am I missing any grant, or there is an issue with the Web UI not listing the targets?
Hi, I am having issues with the role grants. I'm not being able to grant access to only one target from one project to a user.
Terraform code:
I have tested:
I always get a 403 :(
It only works if I add
*
in the id:Thanks!