Uploaded image for project: 'Help-Desk'
  1. Help-Desk
  2. HELP-8244

[fiware-stackoverflow] FIWARE - Keyrock tokens with general permission enabling unauthorized access to applications (security issue?)

        Details

          Description

          Created question in FIWARE Q/A platform on 08-02-2017 at 21:02
          Please, ANSWER this question AT http://stackoverflow.com/questions/42123486/fiware-keyrock-tokens-with-general-permission-enabling-unauthorized-access-to

          Question:
          FIWARE - Keyrock tokens with general permission enabling unauthorized access to applications (security issue?)

          Description:
          In a local Keyrock instance, we have two users, A and B, with two different applications, AppA and AppB, respectively. Both users are distinct from the default "admin" user "idm". The Wilma PEP Proxy is configured with PEP credentials from user A. The problem is that user B can get a valid token from the Keyrock IdM and can access successfully the AppA (which, as mentioned, is registered in Wilma PEP Proxy with PEP credentials from user A).

          Is this a default behavior of Keyrock+Wilma components (GE's) or is this really a security problem? I think the user B should not get access to application of user A. It seems that all tokens are general and have access to all applications independently of users. Am I missing some understanding about all this process?

            Activity

            Ascending order - Click to sort in descending order
            backlogmanager Backlog Manager created issue -
            Hide
            Permalink
            backlogmanager Backlog Manager added a comment -

            2017-02-09 00:05|CREATED monitor | # answers= 0, accepted answer= False

            Show
            backlogmanager Backlog Manager added a comment - 2017-02-09 00:05|CREATED monitor | # answers= 0, accepted answer= False
            backlogmanager Backlog Manager made changes -
            Field Original Value New Value
            Component/s FIWARE-TECH-HELP [ 10278 ]
            fla Fernando Lopez made changes -
            HD-Enabler KeyRock [ 10889 ]
            Description
            Created question in FIWARE Q/A platform on 08-02-2017 at 21:02
            {color: red}Please, ANSWER this question AT{color} http://stackoverflow.com/questions/42123486/fiware-keyrock-tokens-with-general-permission-enabling-unauthorized-access-to


            +Question:+
            FIWARE - Keyrock tokens with general permission enabling unauthorized access to applications (security issue?)

            +Description:+
            In a local Keyrock instance, we have two users, A and B, with two different applications, AppA and AppB, respectively. Both users are distinct from the default "admin" user "idm". The Wilma PEP Proxy is configured with PEP credentials from user A. The problem is that user B can get a valid token from the Keyrock IdM and can access successfully the AppA (which, as mentioned, is registered in Wilma PEP Proxy with PEP credentials from user A).

            Is this a default behavior of Keyrock+Wilma components (GE's) or is this really a security problem? I think the user B should not get access to application of user A. It seems that all tokens are general and have access to all applications independently of users. Am I missing some understanding about all this process?
            		 Created question in FIWARE Q/A platform on 08-02-2017 at 21:02
            {color: red}Please, ANSWER this question AT{color} http://stackoverflow.com/questions/42123486/fiware-keyrock-tokens-with-general-permission-enabling-unauthorized-access-to


            +Question:+
            FIWARE - Keyrock tokens with general permission enabling unauthorized access to applications (security issue?)

            +Description:+
            In a local Keyrock instance, we have two users, A and B, with two different applications, AppA and AppB, respectively. Both users are distinct from the default "admin" user "idm". The Wilma PEP Proxy is configured with PEP credentials from user A. The problem is that user B can get a valid token from the Keyrock IdM and can access successfully the AppA (which, as mentioned, is registered in Wilma PEP Proxy with PEP credentials from user A).

            Is this a default behavior of Keyrock+Wilma components (GE's) or is this really a security problem? I think the user B should not get access to application of user A. It seems that all tokens are general and have access to all applications independently of users. Am I missing some understanding about all this process?
            HD-Chapter Security [ 10841 ]
            fla Fernando Lopez made changes -
            Assignee Alvaro Alonso [ aalonsog ]
            aalonsog Alvaro Alonso made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            aalonsog Alvaro Alonso made changes -
            Status In Progress [ 3 ] Answered [ 10104 ]
            aalonsog Alvaro Alonso made changes -
            Resolution Done [ 10000 ]
            Status Answered [ 10104 ] Closed [ 6 ]
            fla Fernando Lopez made changes -
            Fix Version/s 2021 [ 12600 ]
            Transition Time In Source Status Execution Times Last Executer Last Execution Date
            Open Open In Progress In Progress
            		12h 20m 1 Alvaro Alonso 09/Feb/17 12:25 PM
            In Progress In Progress Answered Answered
            		1s 1 Alvaro Alonso 09/Feb/17 12:25 PM
            Answered Answered Closed Closed
            		1s 1 Alvaro Alonso 09/Feb/17 12:25 PM

              People

              • Assignee:
                aalonsog Alvaro Alonso
                Reporter:
                backlogmanager Backlog Manager
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: