Reject invalid tenant ids

Activity

Show:

Craig McNally August 17, 2023 at 3:18 PM

will take a look to see where this stands and the security team can discuss next steps afterwards

Adam Dickmeiss October 4, 2022 at 11:16 AM

Work reverted . There's a PR which allows existing tenant ID - see https://folio-org.atlassian.net/browse/OKAPI-1121#icft=OKAPI-1121

Craig McNally March 3, 2022 at 4:28 PM

The security team has reviewed this and assigned priority. Ideally we can get this fixed in Morning Glory.

Next steps:

  1. to discuss the set of restrictions with the core-platform team.

  2. Reach out to the implementers once we have an agreed-upon set of restrictions.  The purpose is two-fold: 

    1. See how prevalent this problem is.  And

    2. let them know that they shouldn't be creating new tenants based on the restrictions outlined in https://folio-org.atlassian.net/browse/OKAPI-1081#icft=OKAPI-1081.

      1. Maybe we should have OKAPI reject new tenants based on these restrictions, but allow pre-existing tenants that are already in place.

  3. Brainstorm what migrations would look like - what is the scope?  Stripes-config, edge API keys, etc. would all need to change.  What else is impacted?

Adam Dickmeiss March 3, 2022 at 3:40 PM

Fortunately, Okapi does have some checks already. For example not allowing upper-case.

Done

Details

Assignee

Reporter

Priority

Story Points

Development Team

Core: Platform

Fix versions

Release

Quesnelia (R1 2024)

Affected Institution

GBV

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs
Created March 3, 2022 at 2:03 PM
Updated March 28, 2024 at 3:57 PM
Resolved February 28, 2024 at 10:09 PM
TestRail: Cases
TestRail: Runs

Flag notifications