Why retrive all namespaces when user is not authenticated

[adobemomo]

/kind question

Question:
I am trying to authenticate user with Azure AD. The header sent to Kubeflow contains no Authorization token now, so the user is anonymous@kubeflow.org. And I read through the centraldashboard-v1.6.1/app/api_workgroup.ts

    /**
     * Builds EnvironmentInfo for the case without identity awareness
     */
    private async getBasicEnvironment(user: User.User): Promise<EnvironmentInfo> {
        const [platform, namespaces] = await Promise.all([
            this.getPlatformInfo(),
            this.getAllWorkgroups(user.email),
        ]);
        return {
            user: user.email,
            platform,
            namespaces,
            isClusterAdmin: true,
        };
    }
    /**
     * Retrieves all namespaces in case of basic auth.
     */
    async getAllWorkgroups(fakeUser: string): Promise<SimpleBinding[]> {
        const bindings = await this.profilesService.readBindings();
        const namespaces = mapWorkgroupBindingToSimpleBinding(
            bindings.body.bindings || []
        );
        const names = new Set(namespaces.map((n) => n.namespace));
        return Array.from(names).map((n) => ({
            namespace: n,
            role: 'contributor',
            user: fakeUser,
        }));
    }

When !req.user.hasAuth, it will get all existing profiles, this anonymous@kubeflow.org can modify resources in other profiles. What's the purpose of this design? Or do I get something wrong?

[juliusvonkohout]

Feel free to join the security wg meeting

[adobemomo]

Feel free to join the security wg meeting

Hi @juliusvonkohout, do you know what is this wg meeting and where can I find it?

[juliusvonkohout]

Yes, here you can find it https://www.kubeflow.org/docs/about/community/#kubeflow-community-calendars

Please also join the channel security-team on slack, since the meeting time might change.

[andreyvelich]

/transfer notebooks

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity.
It will be closed if no further activity occurs.
Thank you for your contributions.

Members may comment /lifecycle frozen to prevent this issue from being marked as stale.