Fix member_role_policy_template for Openbao
Why this MR ?
- To close this issue
- We have a bug in the ACL policy template for member_role_policy
- It does not handle the case where the
member_role_id:claim isnilin the OIDC JWT token
What does this MR do ?
- Update the ACL policy template for member_role_policy to handle the case where
member_role_id:is NOT present in the JWT - The solution is to as suggested in the docs, to add a guard clause using the
indexfunction. - If
member_role_id:claim is NOT present in the JWT, we excludemember_role_policy_templatefrom the list of policy templates
References
Screenshots
| Logs for project provisioned with buggy template | Logs for project provisioned with fixed template |
|---|---|
"policies":["default","project_70/users/direct/user_2","project_70/users/roles/50", "project_70/users/direct/member_role_\u003cno value\u003e"] |
"policies":["default","project_75/users/direct/user_2","project_75/users/roles/50"] |
"token_policies":["default","project_70/users/direct/user_2","project_70/users/roles/50", "project_70/users/direct/member_role_\u003cno value\u003e"] |
"token_policies":["default","project_75/users/direct/user_2","project_75/users/roles/50"] |
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Jayakrishnan Mallissery