fleet/changes/16288-conditional-access-authz at e004b0e00f4e036b9b64d6a6ed2ca441bf1c02a8 - fleet - Gitea: Git with a cup of tea

Discharge7443/fleet

Files

T

Lucas Manuel Rodriguez 608bd2764c Restrict conditional access Okta IdP asset endpoints to privileged roles (#48294 )

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated (authorization policy change
only).

## Testing

- [x] Added/updated automated tests — the role matrix in
`TestConditionalAccessGetIdPSigningCertAuth` and
`TestConditionalAccessGetIdPAppleProfileAuth` now asserts observer and
observer+ are denied; `go test ./server/authz/` confirms the policy
compiles.
- [x] QA'd all new/changed functionality manually — covered by the
automated role-matrix tests for this authz-only change.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Tightened access to conditional access identity provider assets so
only higher-privilege roles can read them.
* Users with observer and observer+ roles can no longer access these
endpoints.
  * Updated validation coverage to reflect the revised access behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-06-25 15:57:25 -03:00

2 lines

137 B

Plaintext

Raw Blame History

- Restricted authorization for conditional access Okta IdP asset endpoints so that observer and observer+ roles can no longer read them.