From cf46e596805177a9b40de4ce42d8732647b0b78c Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Sun, 19 Jul 2026 17:55:04 -0400 Subject: [PATCH] fix(rig): seed LDAP group mappings with the canonical role names docker/seed-sites.sh inserted the pre-rename 'Design' / 'Deployment' role strings, but the canonical vocabulary in Roles.cs is 'Designer' / 'Deployer'. The mismatch authorized nothing: on a freshly reseeded rig every Designer/Deployer-gated management command failed UNAUTHORIZED, including seed-sites.sh's own trailing `deploy artifacts` and reseed.sh's stage 6d encrypted-secret restore. Found while standing up the Phase 2 soak rig. Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts --- docker/seed-sites.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/docker/seed-sites.sh b/docker/seed-sites.sh index fa5c7102..2d2bc8eb 100755 --- a/docker/seed-sites.sh +++ b/docker/seed-sites.sh @@ -96,7 +96,7 @@ for ident in site-a site-b site-c; do done echo "" -echo "Seeding LDAP group mappings (Design + Deployment)..." +echo "Seeding LDAP group mappings (Designer + Deployer)..." # SecurityConfiguration.HasData declares 4 mappings but the InitialSchema # migration only inserts the Admin row, so a fresh ScadaBridgeConfig starts # with multi-role getting Admin only -- no Design and no Deployment access. @@ -106,11 +106,16 @@ docker exec -i scadabridge-mssql /opt/mssql-tools18/bin/sqlcmd \ -d ScadaBridgeConfig -Q " SET IDENTITY_INSERT LdapGroupMappings ON; IF NOT EXISTS (SELECT 1 FROM LdapGroupMappings WHERE Id = 2) - INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (2, 'SCADA-Designers', 'Design'); + INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (2, 'SCADA-Designers', 'Designer'); IF NOT EXISTS (SELECT 1 FROM LdapGroupMappings WHERE Id = 3) - INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (3, 'SCADA-Deploy-All', 'Deployment'); + INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (3, 'SCADA-Deploy-All', 'Deployer'); IF NOT EXISTS (SELECT 1 FROM LdapGroupMappings WHERE Id = 4) - INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (4, 'SCADA-Deploy-SiteA', 'Deployment'); + INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (4, 'SCADA-Deploy-SiteA', 'Deployer'); +-- Role strings MUST match the canonical vocabulary in +-- src/ZB.MOM.WW.ScadaBridge.Security/Roles.cs ('Designer' / 'Deployer'). +-- These rows previously carried the pre-rename 'Design' / 'Deployment', which +-- authorized nothing: every Designer/Deployer-gated management command failed +-- UNAUTHORIZED on a freshly reseeded rig. SET IDENTITY_INSERT LdapGroupMappings OFF; "