Actuator permissions granted by error to osb user - Githubissues

orange-cloudfoundry / osb-cmdb

A configuration management db for Open Service Broker API broker implementations

Apache License 2.0

14 stars 1 forks source link

Actuator permissions granted by error to osb user #67

Closed gberche-orange closed 3 years ago

gberche-orange commented 4 years ago

Expected behavior

As an osb-cmdb operator

in order to secure actuator endpoints that may be used to trigger denial of service (e.g. by triggering thread dump or increasing log verbosity)
I need osb logged in user to be denied access to actuator endpoints

Observed behavior

Osb-user were given by mistake the ADMIN role and as such be granted access to actuator endpoints

Affected release

Reproduced on version 1.1.0