search

tapis-project / tapis-java

Texas Advanced Computing Center APIs
BSD 3-Clause "New" or "Revised" License
5 stars 6 forks source link

Improve role-doesn't-exist error message #31

Open richcar58 opened 3 years ago

richcar58 commented 3 years ago

Return an error message that indicates that a role doesn't exist rather than an authorization error on various apis that reference a role (e.g., grantRole)

richcar58 commented 2 years ago

Authorization errors that might occur when issuing a grantRole or related call look like this:

SK_API_AUTHORIZATION_FAILED These authorization checks failed for request tenant/user=dev/bozo (jwt tenant/user=admin/jobs, obo tenant/user=dev/bozo, account=service): IsAdmin, OwnedRoles

Though somewhat cryptic the message conveys the user context and the authorization checks that did not pass. In this case, the caller was neither a tenant administrator nor the owner of the role. Telling the user whether or not the role exists leaks security information. For example, a potential attacker could use knowledge that the role exists but is owned by another user. Authorization checks will pass on if the user is authorized to act upon an existing role. We can revisit this in the future, but for now let's stay with the caution approach.