Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

permissions enum doesn't contain "Invalid" #1962

Closed
dovholuknf opened this issue Apr 19, 2024 · 1 comment
Closed

permissions enum doesn't contain "Invalid" #1962

dovholuknf opened this issue Apr 19, 2024 · 1 comment
Assignees
Labels
bug Something isn't working

Comments

@dovholuknf
Copy link
Member

When enumerating services as an administrator using the management api, such as ziti edge list services -j, if the identity doesn't have permissions because no service policy exists to grant the admin access, the permissions array returns "Invalid":

"permissions": [
                "Invalid"
            ]

This causes problems with generated clients because "Invalid" doesn't appear in the spec

@dovholuknf dovholuknf added the bug Something isn't working label Apr 19, 2024
@andrewpmartinez andrewpmartinez self-assigned this Apr 19, 2024
@andrewpmartinez
Copy link
Member

Tracing it through the code is because of the change to admin access where dial/bind is no longer assumed, and instead, Invalid is purposefully returned.

The downside is that the spec was never updated, and any admin client accessing the service list will encounter similar errors. Most OpenAPI clients are generated with value checking for enumerations and will not accept unknown values.

The workaround is to hand patch the dialBind enum and add —Invalid and then regenerate your client.

Once a new version of ziti is released with this issue fixed, upgrading and regenerating from the spec the controller provides will also fix the issue.

andrewpmartinez added a commit to openziti/edge-api that referenced this issue Apr 19, 2024
- Invalid is intentionally returned by the controller for admins who can
  see services but do not have a policy to access them.
andrewpmartinez added a commit that referenced this issue Apr 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants