mirror of
https://github.com/apache/cloudstack
synced 2026-08-02 21:38:30 +00:00
9a13227a78
CloudStack SSO (using security.singlesignon.key) does not work anymore with CloudStack 4.11, since commit9988c26, which introduced a regression due to a refactoring: every API request that is not "validated" generates the same error (401 - Unauthorized) and invalidates the session. However, CloudStack UI executes a call to listConfigurations in method bypassLoginCheck. A non-admin user does not have the permissions to execute this request, which causes an error 401: {"listconfigurationsresponse":{"uuidList":[],"errorcode":401,"errortext":"unable to verify user credentials and/or request signature"}} The session (already created by SSO) is then invalidated and the user cannot access to CloudStack UI (error "Session Expired"). Before9988c26(up to CloudStack 4.10), an error 432 was returned (and ignored): {"errorresponse":{"uuidList":[],"errorcode":432,"cserrorcode":9999,"errortext":"The user is not allowed to request the API command or the API command does not exist"}} Even if the call to listConfigurations was removed, another call to listIdps also lead to an error 401 for user accounts if the SAML plugin is not enabled. This pull request aims to fix the SSO issue, by restoring errors 432 (instead of 401 + invalidate session) for commands not available. However, if an API command is explicitly denied using ACLs or if the session key is incorrect, it still generates an error 401 and invalidates the session.
37 lines
1.3 KiB
Java
37 lines
1.3 KiB
Java
// Licensed to the Apache Software Foundation (ASF) under one
|
|
// or more contributor license agreements. See the NOTICE file
|
|
// distributed with this work for additional information
|
|
// regarding copyright ownership. The ASF licenses this file
|
|
// to you under the Apache License, Version 2.0 (the
|
|
// "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
package com.cloud.exception;
|
|
|
|
import com.cloud.utils.SerialVersionUID;
|
|
|
|
public class UnavailableCommandException extends PermissionDeniedException {
|
|
|
|
private static final long serialVersionUID = SerialVersionUID.UnavailableCommandException;
|
|
|
|
protected UnavailableCommandException() {
|
|
super();
|
|
}
|
|
|
|
public UnavailableCommandException(String msg) {
|
|
super(msg);
|
|
}
|
|
|
|
public UnavailableCommandException(String msg, Throwable cause) {
|
|
super(msg, cause);
|
|
}
|
|
}
|
