mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-19 22:14:25 +00:00
65 lines
2.4 KiB
Plaintext
65 lines
2.4 KiB
Plaintext
---
|
|
title: Technical Advisory 10007
|
|
description: "A-10007: Upcoming ZITADEL versions apply RBAC to system users with new SYSTEM_OWNER role affecting custom permission mappings"
|
|
---
|
|
|
|
## Date and Version
|
|
|
|
Version: Upcoming
|
|
|
|
Date: Upcoming
|
|
|
|
## Affected Users
|
|
|
|
This advisory applies to self-hosted ZITADEL installations with custom roles to permissions mappings in the *InternalAuthZ.RolePermissionMappings* configuration section.
|
|
|
|
## Description
|
|
|
|
In upcoming ZITADEL versions, RBAC also applies to [system users defined in the ZITADEL runtime configuration](/guides/integrate/zitadel-apis/access-zitadel-system-api#runtime-settings).
|
|
This enables fine-grained access control to the system API as well as other APIs for system users.
|
|
ZITADEL defines the new default roles *SYSTEM_OWNER* and *SYSTEM_OWNER_VIEWER*.
|
|
System users without any memberships defined in the configuration will be assigned the *SYSTEM_OWNER* role.
|
|
**Self-hosting users who define their own custom mapping at the *InternalAuthZ.RolePermissionMappings* configuration section**, have to define the *SYSTEM_OWNER* role in their configuration too to be able to access the system API with the default system user membership.
|
|
|
|
## Statement
|
|
|
|
This change is tracked in the following PR: [feat: add SYSTEM_OWNER role](https://github.com/zitadel/zitadel/pull/6765).
|
|
As soon as the release version is published, we will include the version here.
|
|
|
|
## Mitigation
|
|
|
|
If you have a custom role mapping configured, make sure you configure the new role *SYSTEM_OWNER* before migrating to upcoming ZITADEL versions.
|
|
As a reference, these are the default mappings:
|
|
|
|
```yaml
|
|
InternalAuthZ:
|
|
RolePermissionMappings:
|
|
- Role: "SYSTEM_OWNER"
|
|
Permissions:
|
|
- "system.instance.read"
|
|
- "system.instance.write"
|
|
- "system.instance.delete"
|
|
- "system.domain.read"
|
|
- "system.domain.write"
|
|
- "system.domain.delete"
|
|
- "system.debug.read"
|
|
- "system.debug.write"
|
|
- "system.debug.delete"
|
|
- "system.feature.write"
|
|
- "system.limits.write"
|
|
- "system.limits.delete"
|
|
- "system.quota.write"
|
|
- "system.quota.delete"
|
|
- "system.iam.member.read"
|
|
- Role: "SYSTEM_OWNER_VIEWER"
|
|
Permissions:
|
|
- "system.instance.read"
|
|
- "system.domain.read"
|
|
- "system.debug.read"
|
|
...
|
|
```
|
|
|
|
## Impact
|
|
|
|
If the system users don't have the correct memberships and roles which resolve to permissions, the system users lose access to the system API.
|