Enduser can fetch all organizations from api?

p2-inc / keycloak-orgs

Single realm, multi-tenancy for SaaS apps

Other

361 stars 65 forks source link

Enduser can fetch all organizations from api? #183

Closed jaakkom closed 4 months ago

jaakkom commented 4 months ago

Is there supposed to be some kind of authorization on /orgs api? Currently anyone can fetch organizations with valid token. I think it should be somehow limited, now it reveals all "organizations" to all endusers.

xgp commented 4 months ago

https://github.com/p2-inc/keycloak-orgs/blob/main/src/main/java/io/phasetwo/service/resource/OrganizationsResource.java#L99

Can you please show an example request for which a user without the view permission can call this so we can reproduce? Thanks.

jaakkom commented 4 months ago

Confirmed, it only shows organizations where user belongs to, just like orgs/me but different payload. My fault!