andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-28 10:02:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix(security): check auth method permission on the user's organization

ListUserAuthMethodTypes checked user.read against the caller's own
organization instead of the organization owning the requested user. Any
org level role holding user.read - ORG_OWNER, ORG_OWNER_VIEWER - therefore
passed the check for every user of the instance, and the query itself
filters on instance and user id only, so it returned that user's
authentication methods across the organization boundary.

Resolve the requested user first and check the permission on its resource
owner, the same resolution GetUserByIDWithPermission already uses.

This covers both the v2 and v2beta ListAuthenticationMethodTypes handlers,
which share this function. The two login UI callers scope the context to
the user itself, so they keep skipping the check and pay no extra query.

Note that a request for a non existing user id now returns NotFound
instead of an empty list, which also removes an existence oracle.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MeUQhL2hxvnYbPn3qhWJAL

* test(user/v2): cover cross-organization auth method enumeration

TestServer_ListAuthenticationMethodTypes_CrossOrg fails without the
preceding fix: an ORG_OWNER and an ORG_OWNER_VIEWER of one organization
could list the authentication methods of a user of another organization,
leaking AUTHENTICATION_METHOD_TYPE_PASSWORD.

The two own-org subtests are positive controls, not decoration.
Memberships and auth methods are projected asynchronously, so without them
a denial could pass for the wrong reason - a membership that has not been
projected yet. The IAM_USER_MANAGER subtest pins that instance wide
user.read keeps working across organizations, so the fix narrows the
organization without narrowing the role set.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MeUQhL2hxvnYbPn3qhWJAL

---------

Co-authored-by: Claude Opus 5 <[email protected]>
This commit is contained in:
Marco A.
2026-09-04 05:57:02 +02:00
committed by GitHub
co-authored by Claude Opus 5
parent dbbab75420
commit f3dcfa3db6
2 changed files with 83 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/query/user_auth_method.go
+6 -1
View File
@@ -194,7 +194,12 @@ func (q *Queries) searchUserAuthMethods(ctx context.Context, queries *UserAuthMe
func (q *Queries) ListUserAuthMethodTypes(ctx context.Context, userID string, activeOnly bool, includeWithoutDomain bool, queryDomain string) (userAuthMethodTypes *AuthMethodTypes, err error) {
ctxData := authz.GetCtxData(ctx)
if ctxData.UserID != userID {
if err := q.checkPermission(ctx, domain.PermissionUserRead, ctxData.OrgID, userID); err != nil {
// Check against the organization owning the user, not the caller's own organization.
user, err := q.GetUserByID(ctx, false, userID)
if err != nil {
return nil, err
}
if err := q.checkPermission(ctx, domain.PermissionUserRead, user.ResourceOwner, userID); err != nil {
return nil, err
}
}