ACL: ConfigDbApiKeyStore confers roles from Cluster-scoped grants in ANY cluster #528

New Issue

2026-08-01T01:10:30-04:00

dohertj2 commented

2026-08-01 01:10:30 -04:00

Fixed in 3a6b2a1d (#520 stage 3). Filed for the record — this one reached master in fbe7403c.

ConfigDbApiKeyStore.LoadClusterGrantsAsync selected a principal's grants with
Where(a => a.Principal == principal && a.ScopeKind == NodeAclScopeKind.Cluster) and no ClusterId
predicate. The ConfigDb holds the whole fleet's NodeAcl rows, so on a fused admin,driver node a
Cluster-scoped grant authored in any cluster conferred the server-wide WriteOperate /
AlarmAcknowledge role.

ArtifactApiKeyStore was never affected: it reads a snapshot DeploymentArtifact.ParseDataPlaneAuthority
has already narrowed with ClusterFilterMode.ScopeTo. The two stores' behaviour diverged while
ArtifactApiKeyStore's doc comment claimed it was "matching ConfigDbApiKeyStore" — it matched on scope
kind but not on cluster.

Fix. The store takes the node's own ClusterId, derived from AkkaClusterOptions via
RoleParser.IsClusterRole/ClusterIdFromRole (options, not IClusterRoleInfo — resolving that from the
SP is the documented boot-StackOverflow landmine). A null ClusterId applies no filter, mirroring
ClusterFilterMode.None, so single-cluster deployments are unchanged.

The cluster match is done in memory after the SQL fetch, deliberately: ParseDataPlaneAuthority matches
OrdinalIgnoreCase, and a.ClusterId == clusterId in SQL is decided by database collation instead. That is
not theoretical — Cluster:Roles binds verbatim (cluster-MAIN ⇒ MAIN) while the OTOPCUA_ROLES path
goes through RoleParser.Parse, which lowercases (⇒ main).

Regression test staged red→green: ConfigDbApiKeyStoreTests.A_cluster_scoped_grant_from_another_cluster_confers_nothing.

**Fixed in `3a6b2a1d` (#520 stage 3). Filed for the record — this one reached `master` in `fbe7403c`.** `ConfigDbApiKeyStore.LoadClusterGrantsAsync` selected a principal's grants with `Where(a => a.Principal == principal && a.ScopeKind == NodeAclScopeKind.Cluster)` and **no `ClusterId` predicate**. The ConfigDb holds the whole fleet's `NodeAcl` rows, so on a fused `admin,driver` node a `Cluster`-scoped grant authored in *any* cluster conferred the server-wide `WriteOperate` / `AlarmAcknowledge` role. `ArtifactApiKeyStore` was never affected: it reads a snapshot `DeploymentArtifact.ParseDataPlaneAuthority` has already narrowed with `ClusterFilterMode.ScopeTo`. The two stores' behaviour diverged while `ArtifactApiKeyStore`'s doc comment claimed it was "matching `ConfigDbApiKeyStore`" — it matched on scope kind but not on cluster. **Fix.** The store takes the node's own ClusterId, derived from `AkkaClusterOptions` via `RoleParser.IsClusterRole`/`ClusterIdFromRole` (options, not `IClusterRoleInfo` — resolving that from the SP is the documented boot-`StackOverflow` landmine). A null ClusterId applies no filter, mirroring `ClusterFilterMode.None`, so single-cluster deployments are unchanged. The cluster match is done **in memory after the SQL fetch**, deliberately: `ParseDataPlaneAuthority` matches `OrdinalIgnoreCase`, and `a.ClusterId == clusterId` in SQL is decided by database collation instead. That is not theoretical — `Cluster:Roles` binds verbatim (`cluster-MAIN` ⇒ `MAIN`) while the `OTOPCUA_ROLES` path goes through `RoleParser.Parse`, which lowercases (⇒ `main`). Regression test staged red→green: `ConfigDbApiKeyStoreTests.A_cluster_scoped_grant_from_another_cluster_confers_nothing`.

dohertj2 closed this issue

2026-08-01 01:10:30 -04:00

dohertj2 referenced this issue

2026-08-01 01:10:46 -04:00

Node ACLs are authored and deployed but never enforced — wire IPermissionEvaluator or retire the surface #520

dohertj2 referenced this issue from a commit

2026-08-01 02:38:21 -04:00

fix(cluster,acl): OTOPCUA_ROLES fallback + one string-identity rule (#532, #533)

dohertj2 referenced this issue

2026-08-01 02:39:22 -04:00

Node ACLs are authored and deployed but never enforced — wire IPermissionEvaluator or retire the surface #520

Sign in to join this conversation.