Return realm configs based on mgt permission #980
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| user.setTenantDomain(tenantDomain); | ||
| RealmConfig realmConfig = null; | ||
|
|
||
| try { |
There was a problem hiding this comment.
Log Improvement Suggestion No: 1
Suggested change
| try { | |
| try { | |
| if (log.isDebugEnabled()) { | |
| log.debug("Getting server configurations for tenant: " + tenantDomain); | |
| } | |
| boolean isUerAuthorizedToViewInternalConfig; |
Comment on lines
253
to
255
| isUerAuthorizedToViewInternalConfig = | ||
| AuthzUtil.isUserAuthorized(user, Collections.singletonList("internal_config_view")); | ||
| } |
There was a problem hiding this comment.
Log Improvement Suggestion No: 2
Suggested change
| isUerAuthorizedToViewInternalConfig = | |
| AuthzUtil.isUserAuthorized(user, Collections.singletonList("internal_config_view")); | |
| } | |
| isUerAuthorizedToViewInternalConfig = | |
| AuthzUtil.isUserAuthorized(user, Collections.singletonList("internal_config_view")); | |
| } | |
| if (log.isDebugEnabled()) { | |
| log.debug("User authorization status for viewing internal config: " + isUerAuthorizedToViewInternalConfig); | |
| } |
AI Agent Log Improvement Checklist
✅ Before merging this pull request:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose
This pull request enhances the authorization logic in the
ServerConfigManagementService#getConfigsmethod to ensure that only users with the appropriate permissions can view internal configuration details. The changes introduce user-specific authorization checks and handle sub-organization scenarios, improving security and compliance with organizational boundaries.Authorization and Security Improvements:
AuthzUtil.isUserAuthorizedwith the relevant permission (internal_org_config_viewfor sub-organizations,internal_config_viewotherwise).AuthenticatedUserobject from the current context to use in permission checks, ensuring authorization is performed for the correct user.Error Handling Enhancements:
IdentityOAuth2ExceptionandOrganizationManagementExceptionduring authorization checks, returning an internal server error if an exception occurs.Dependency Additions:
AuthenticatedUser,IdentityOAuth2Exception, andAuthzUtilto support the new authorization logic. [1] [2]Depends on