You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently working on the bisect, guides me to 0bf95c3 as the first "broken" commit I can build.
I believe the issue introduced in the commit above was only partially fixed by f9354b3, and the user query is still broken today.
This means it is not possible to use a clean install of the latest thehive right now.
miyoyo
changed the title
[Bug] Users are not assigned to organisations when created using the v1 user creation API
[Bug] Admin user does not have the right to list users of other organisations
Oct 25, 2020
The query listUser only lists users who are in the organisation of the current authenticated user (the requester).
An user can only list users of his organisations. The problem occurs because the admin user is only is "admin" organisation. The admin users (users in admin organisation) are a special case (which was not correctly treated).
If you want all users of an org, use {"query":[{"_name":"getOrganisation","idOrName":"orgName"},{"_name":"users"}]}
If you want all users, use {"query":[{"_name":"listOrganisation"},{"_name":"users"}]}
Request Type
Bug
Work Environment
Problem Description
Creating an user using the web interface after logging in as admin (admin/secret) leads to the user not showing up in the interface.
Using a direct query to listUser will show the user as having "no org"
Update: Creating an user using the v0 or v1 API still cause the user to have "no org" EXCEPT if the organization is "Admin", then it works fine.Update 2: It seems that the user list api, the organisation list api, and the user create API don't return truthful values.
I created a profile using this request:
And the response was
Which both lies about hasPassword and the organisation.
The organisation is actually assigned, as logging in as the user shows the correct organisation in the top right of the screen.
Once logged in as the user, correct values are given.
Properly outputs
Which makes me think that admin users do not have the right to see users in other organizations.
Steps to Reproduce
Possible Solutions
7cc8d5c
This commit seems to be where the string "no org" appeared, I'll attempt to build on the parent commit to see if this is the faulty commit.
Complementary information
"listUser" query with v1 api
The text was updated successfully, but these errors were encountered: