Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Expanded permissions causing stack overflow preventing login

Description

When a user tries to log into FOLIO, eventually mod-permissions is called with the following URL: /perms/users/<id>/permissions?expanded=true&full=true

It appears, depending on the users' permission list, that we can get in either a very deep recursion or we are in infinite recursion.

This happened in the BugFest environment.

URL: /perms/users/554d9cb7-7d3d-4ab6-84e9-17daccba1f80/permissions?expanded=true&full=true

Permissions user in the DB:

CSP Request Details

None

CSP Rejection Details

None

Potential Workaround

None

Checklist

hide

TestRail: Results

Activity

Show:

Hongwei Ji September 24, 2019 at 10:51 AM

I was able to reproduce the problem using a circular permission dependency. Will look into fixing it.

Jakub Skoczen September 20, 2019 at 6:24 PM

Thanks . We will address it next week.

Cate Boerema September 20, 2019 at 6:09 PM

This workaround sounds risky. I think we should at least explore the option of getting it fixed for 3.2. I see assigned this to Core Platform. are you aware of this issue yet?

Matt Reno September 20, 2019 at 2:33 PM
Edited

I believe it could be worked around by being careful with our permission sets, so there are no circular references, but we did not test out that theory. It is likely why certain users are experiencing login failure.

If we could run into it in BugFest, then any tenant could, including Chalmers.

Cate Boerema September 20, 2019 at 2:24 PM

This sounds pretty bad, . Is this what was causing so many people to not be able to log in? I assume this is a must-fix for 3.2 or we risk similar issues for Chalmers, correct?

Done

Details

Assignee

Reporter

Labels

Priority

Story Points

Sprint

Development Team

Core: Platform

Fix versions

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs
Created September 19, 2019 at 2:56 PM
Updated January 3, 2020 at 2:22 PM
Resolved September 25, 2019 at 1:32 PM
TestRail: Cases
TestRail: Runs