search

littlehorse-enterprises / littlehorse

This repository contains the code for the LittleHorse Server, Dashboard, CLI, and Java/Go/Python SDK's. Brought to you by LittleHorse Enterprises LLC
https://littlehorse.dev/
Other
66 stars 7 forks source link

Users able to reveal Tenants they are not assigned to #901

Open Snarr opened 4 weeks ago

Snarr commented 4 weeks ago

Context

A user with the ALL_RESOURCES ACL can search for and reveal the existence of tenants even when they are not assigned to them.

Steps To Reproduce

  1. Create a Principal within an lhCluster that has the ACL_ALL_RESOURCES ACL permission scoped to a specific tenant (example: test).
  2. Create another tenant within the same lhCluster that the new Principal does not have access to.
  3. Run a SearchTenant request as the Principal defined in Step 1.
  4. BUG: Server returns both tenants, including the one the Principal is assigned to AND the one the Principal is not assigned to

Expected Behavior

A non-admin user with the ALL_RESOURCES permission that runs a SearchTenant request should only receive a list of the tenants they are assigned to. This is to protect the privacy of other tenants within the same cluster.

Screenshots

No response

Additional Context

No response

Components

Server