Sharon Katz
2f0c1b338a
**Related issue:** N/A # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests ## Summary Restricts SCIM endpoint access to global admin users only. Previously, global maintainers also had access, which is broader than necessary. ### Changes - **`server/authz/policy.rego`**: Removed `maintainer` from the SCIM authorization rule, leaving only `admin`. - **`ee/server/integrationtest/scim/scim_test.go`**: Updated auth tests to verify maintainers now get 403, and that only admins can access SCIM endpoints. > **Breaking change for 4.89**: Customers using a global maintainer API token for SCIM will need to update to a global admin token before upgrading. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Restricted SCIM endpoint access to global administrators only. * **Bug Fixes** * Prevented unauthorized observer and maintainer users from accessing SCIM reads, writes, and details. * Improved authorization error tracking for denied SCIM requests (including recorded request status and details). * **Tests** * Updated SCIM authorization integration tests to reflect the tightened admin-only access rules. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 lines
60 B
Plaintext
2 lines
60 B
Plaintext
Restricted SCIM endpoint access to global admin users only.
|