Skip to content

Fix: Server throws "User Does not have permission to access this" occasionally (arrow flight endpoint) #847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jul 11, 2024
Merged

Fix: Server throws "User Does not have permission to access this" occasionally (arrow flight endpoint) #847

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ee5bac3
keep admin session active
dharanad Jul 9, 2024
fa72578
override permission if session belongs to admin
dharanad Jul 9, 2024
c7897d2
documentation
dharanad Jul 9, 2024
f66180a
Merge branch 'main' into fix/822
dharanad Jul 9, 2024
b1ba6a5
Merge branch 'main' into fix/822
dharanad Jul 10, 2024
8a96251
fix
dharanad Jul 10, 2024
db6ea92
remove unused code
dharanad Jul 10, 2024
cd802cc
clippy & fmt
dharanad Jul 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions server/src/handlers/airplane.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ use tonic::{Request, Response, Status, Streaming};

use crate::handlers::livetail::extract_session_key;
use crate::metadata::STREAM_INFO;
use crate::rbac;
use crate::rbac::Users;

use super::http::query::get_results_from_cache;
Expand Down Expand Up @@ -231,6 +232,20 @@ impl FlightService for AirServiceImpl {
} else {
None
};

// try authorize
match Users.authorize(key.clone(), rbac::role::Action::Query, None, None) {
rbac::Response::Authorized => (),
rbac::Response::UnAuthorized => {
return Err(Status::permission_denied(
"user is not authenticated to access this resource",
))
}
rbac::Response::ReloadRequired => {
return Err(Status::unauthenticated("reload required"))
}
}

let permissions = Users.get_permissions(&key);

authorize_and_set_filter_tags(&mut query, permissions, &stream_name).map_err(|_| {
Expand Down