Nacos permission Bug

[309283175]

turn on auth system, create new role ROLE_TEST,then add public resource to ROLE_TEST with rw,the data in table permissions is:

role	       resource	action
ROLE_TEST	:*:*	rw

com.alibaba.nacos.console.security.nacos.roles.NacosRoleServiceImpl.hasPermission()

 String permissionResource = permissionInfo.getResource().replaceAll("\\*", ".*");
 String permissionAction = permissionInfo.getAction();
  if (permissionAction.contains(permission.getAction()) &&
       Pattern.matches(permissionResource, permission.getResource())) {
        return true;
 }

if i use spring.cloud.nacos.username=test register my service to nacos with public namespace,my resource is "public:DEFAULT_GROUP:naming/my-service",but the parttern is :.*:.* , Pattern.matches(permissionResource, permission.getResource()) shoud be true but false

com.alibaba.nacos.api.exception.NacosException: failed to req API:/nacos/v1/ns/instance after all servers([x.x.x.x:8848]) tried: ErrCode:403, ErrMsg: authorization failed!

[horizonzy]

Hi, did you bind user test with role ROLE_TEST.

[309283175]

@horizonzy of course i bind user test with role ROLE_TEST.

[309283175]

@horizonzy ,As i mentioned above ,this bug only appear with user not have ROLE_ADMIN and want register to public namespace.

[horizonzy]

I will have a try to reproduce it.

[binbin0325]

when public resource permissions are set, the permissionResource should be public:.*:.*

[309283175]

@sanxun0325 I have tried to modify the resource record of the database :*:* to public:*:* directly. The service registration is successful. but it has caused another problem when I log in to the console with the test user and select the public namespace, a warning of no permission will appear。

[binbin0325]

@sanxun0325 I have tried to modify the resource record of the database :*:* to public:*:* directly. The service registration is successful. but it has caused another problem when I log in to the console with the test user and select the public namespace, a warning of no permission will appear。

nacos server version can be tried with 1.4.0, which fixes the console problem

[309283175]

@sanxun0325 I have tried to modify the resource record of the database :*:* to public:*:* directly. The service registration is successful. but it has caused another problem when I log in to the console with the test user and select the public namespace, a warning of no permission will appear。

nacos server version can be tried with 1.4.0, which fixes the console problem

ok,I will try it again with 1.4.0

[horizonzy]

when public resource permissions are set, the permissionResource should be public:.*:.*

maybe this situation need more thought. If config module, if publishConfig without namespace, it will cause problem.

[binbin0325]

when public resource permissions are set, the permissionResource should be public:.*:.*

maybe this situation need more thought. If config module, if publishConfig without namespace, it will cause problem.

Yes, more testing is needed

[309283175]

when public resource permissions are set, the permissionResource should be public:.*:.*

maybe this situation need more thought. If config module, if publishConfig without namespace, it will cause problem.

@horizonzy @sanxun0325 That's right ,I have retry this scene with 1.4.0,and the problem remains.

[309283175]

Since the public namespace resources stored in the table permissions in the existing database are :*:* , I think we only need to parse the public namespace prefix to a blank string when registering the service. And the Console not need to do anything.
AT com.alibaba.nacos.naming.web.NamingResourceParser.parseName(Object request)
before:
if (StringUtils.isNotBlank(namespaceId)) { sb.append(namespaceId); }
after
if (StringUtils.isNotBlank(namespaceId) && !"public".equals(namespaceId)) { sb.append(namespaceId); }

Similarly, the configuration center is handled in the same way.
AT com.alibaba.nacos.config.server.auth.ConfigResourceParser.parseName(Object request)

I have tested and verified that this problem has been resolved in my local environment.

[horizonzy]

I think we should compatible it in ResourceParser, if the namespace value is 'public', replace it by '';

[KomachiSion]

maybe duplicate with #3524