Loading...

XML

Word

Printable

Details

Type: Epic
Resolution: Fixed
Priority: Critical
Fix Version/s: 4.5.0
Affects Version/s: 4.5.0
Component/s: ns_server
Security Level: Public
Labels:
- security

Epic Name:
RBAC for Admins
Sprint:
ns_server: Dec 28 - Jan 22

Description

With Couchbase 4.0, administrators have permissive access. They can modify cluster settings, bucket configurations, and have full access to data stored by apps. There is no mechanism to block admins from viewing or modifying bucket data in Couchbase. This also includes admins viewing and changing Couchbase cluster settings through the admin console, performing K/V data accesses, using views, or through N1QL.

Attachments

Issue Links

duplicates

MB-10925 UI View Access for Read-Only User

Closed

is duplicated by

MB-8771 Web concole access needs to be logged on server

Closed

relates to

MB-23110 Separation of Duties - Administrators should not be able to see user data

Resolved

mentioned in: Page Loading...; Page Loading...

Gerrit Reviews

- Issue Only
- Show All Reviews
- Show Open Reviews
- Show All Issues
- Show Open Issues

No reviews matched the request. Check your Options in the drop-down menu of this sections header.

Activity

People

Assignee:: Don Pinto [X] (Inactive)

Reporter:: Anil Kumar (Inactive)

Votes:: 0 Vote for this issue

Watchers:: 7 Start watching this issue

Dates

Created:: 04/Jun/14 12:31 PM

Updated:: 25/Jun/18 2:57 AM

Resolved:: 02/May/16 12:42 PM

Gerrit Reviews

There are no open Gerrit changes

Show There are 33 closed Gerrit changes

Hide There are 33 closed Gerrit changes

MB-11314 remove tests from menelaus_auth: Gerrit Review:

MB-11314 use has_permission api to determine if otp cookie: Gerrit Review:

MB-11314 use has_permission api to determine if bucket password: Gerrit Review:

MB-11314 re-factoring of saslauthd_auth to expose methods: Gerrit Review:

MB-11314 initial roles implementation: Gerrit Review:

MB-11314 add preconfigured roles to default config: Gerrit Review:

MB-11314 get rid of is_under_role function: Gerrit Review:

MB-11314 replace filter_accessible_buckets with new style api: Gerrit Review:

MB-11314 couple of helpers for bucket auth: Gerrit Review:

MB-11314 introduce function for authenticating http request: Gerrit Review:

MB-11314 switch ns_server auth to the new system of permissions: Gerrit Review:

MB-11314 remove obsolete stuff from menelaus_auth: Gerrit Review:

MB-11314 re-factoring: move ldap related rest api’s to separate module: Gerrit Review:

MB-11314 add names and descriptions to roles: Gerrit Review:

MB-11314 rest api to get list of available roles: Gerrit Review:

MB-11314 rest api for editing users and assigning roles: Gerrit Review:

MB-11314 rest api for checking permissions: Gerrit Review:

MB-11314 don't use bucket auth for ui issued xhr's: Gerrit Review:

MB-11314 advertise checkPermissionsURI in /pools/default: Gerrit Review:

MB-11314 internal REST api that checks permission for cbauth: Gerrit Review:

MB-11314 return proper identity to golang from _cbauth endpoint: Gerrit Review:

MB-11314 add version of permissions to cbauth cache: Gerrit Review:

MB-11314 advertise /_cbauth/checkPermission endpoint for cbauth: Gerrit Review:

MB-11314 adjust cbauth to new response format of _cbauth call: Gerrit Review:

MB-11314 get rid of CredsImpl.isAdmin and CredsImpl.isROAdmin fields: Gerrit Review:

MB-11314 permissionCheckUrl support on cbauth side: Gerrit Review:

MB-11314 method IsAllowed to check if certain permission is: Gerrit Review:

MB-11314 cache permissions to reduce roundtrips to ns_server: Gerrit Review:

MB-11314 upgrade of saslauthd users to watson: Gerrit Review:

MB-11314 fixed some confusion with wildcards usage: Gerrit Review:

MB-11314 validate roles parameters correctly: Gerrit Review:

MB-11314 correctly print roles with wildcard: Gerrit Review:

MB-11314 write user roles to audit log during login: Gerrit Review:

PagerDuty