Artifact owner is not validated when using createArtifact resource to update artifacts

[kiest]

Description

Registry Version: latest
Persistence type: sql, in-memory

It is possible to update schema owned by another principal via createArtifact API resource (POST /groups/{groupId}/artifacts) with query parameter ifExists=RETURN_OR_UPDATE even when owner-only authorization (OBAC) is enabled.

I think I found the root cause of this issue:

• createArtifact API method is annotated with @Authorized(style = AuthorizedStyle.GroupOnly, level = AuthorizedLevel.Write) which makes sense when creating a new artifact (only group exists at this point). See

  apicurio-registry/app/src/main/java/io/apicurio/registry/rest/v2/GroupsResourceImpl.java

  Line 779 in 97bc1aa

  public ArtifactMetaData createArtifact(String groupId, String xRegistryArtifactType, String xRegistryArtifactId,

  • AbstractAccessController doesn't take into consideration that this API method could be used to update artifacts (by setting query parameter ifExists=RETURN_OR_UPDATE) and never validates artifact owner for this request. See

    apicurio-registry/app/src/main/java/io/apicurio/registry/auth/AbstractAccessController.java

    Line 35 in 97bc1aa

    } else if (style == AuthorizedStyle.GroupOnly && authConfig.ownerOnlyAuthorizationLimitGroupAccess.get()) {

• updateArtifact API method is annotated with @Authorized(style = AuthorizedStyle.GroupAndArtifact, level = AuthorizedLevel.Write) and will make AbstractAccessController validate artifact owner since the artifact should exist at this point - this is an expected behaviour when updating artifacts. See

  apicurio-registry/app/src/main/java/io/apicurio/registry/rest/v2/GroupsResourceImpl.java

  Line 211 in 97bc1aa

  @Authorized(style = AuthorizedStyle.GroupAndArtifact, level = AuthorizedLevel.Write)

• Apicurio Maven plugin uses only createArtifact method for both creating and updating artifacts. See

  apicurio-registry/utils/maven-plugin/src/main/java/io/apicurio/registry/maven/RegisterRegistryMojo.java

  Line 169 in 97bc1aa

  ArtifactMetaData amd = this.getClient().createArtifact(groupId, artifactId, version, type, ifExists, canonicalize, null, null, ContentTypes.APPLICATION_CREATE_EXTENDED, null, null, artifactContent, references);

Environment

Running Apicurio Registry in k8s cluster. Here are some configuration properties that are relevant to this problem:

REGISTRY_AUTH_ENABLED  = true
REGISTRY_AUTH_OBAC_ENABLED = true
KEYCLOAK_URL = <redacted>
KEYCLOAK_REALM = <redacted>

We are using both Apicurio Maven plugin and REST API for creating and updating schemas in Apicurio Registry.

Steps to Reproduce

0. Configure Apicurio Registry to have both auth and OBAC enabled
1. Create an Avro schema and publish it with Apicurio Maven plugin using principal A
2. Change the schema and run Maven plugin with different principal B
3. The schema is successfully updated, even though OBAC should have prevented it

Expected vs Actual Behaviour

Apicurio Registry should check artifact owner even when updating it via createArtifact API resource with ifExists=RETURN_OR_UPDATE when OBAC is enabled. Currently Apicurio Registry allows updating artifacts this way with different principal.

Logs

2023-11-06 15:25:25 INFO <_> [io.apicurio.common.apps.logging.audit.AuditLogService] (executor-thread-54) apicurio.audit action="createArtifact" result="success" src_ip="<redacted>" if_exists="RETURN_OR_UPDATE" artifact_type="AVRO" name_encoded="<redacted>" canonical="true" artifact_id="<redacted same id>" principal_id="<redacted principal A>"

2023-11-06 15:42:55 INFO <_> [io.apicurio.common.apps.logging.audit.AuditLogService] (executor-thread-72) apicurio.audit action="createArtifact" result="success" src_ip="<redacted>" if_exists="RETURN_OR_UPDATE" artifact_type="AVRO" name_encoded="<redacted>" canonical="true" artifact_id="<redacted same id>" principal_id="<redacted principal B>"

[carlesarnal]

I have one comment about the version before trying to reproduce this. You mention latest, but we only publish latest-release and latest-snapshot. Do you mind confirming that this is happening in those?

[kiest]

I was using latest-release when testing this issue (back in November 2023). Also was reproducible with 2.4.2.Final