Access to a document resource. User rights are not applied after they have been granted

Data Services
1

We use the A12 standard setup including UAA.

If we log in with a user who does not have sufficient rights (roles), the resources (models, documents) are not loaded. This corresponds to the expected behavior. Access denied!

If the user is now given the necessary rights, he can still not access the resources after a new login.

The reason is that the method com.mgmtp.a12.dataservices.model.internal.authorization.AbstractModelPermissionEvaluator#hasReadPermission(com.mgmtp.a12.model.header.Header) uses the cachedPermissionEvaluator and does not perform a new check, but returns the previous value (denied).

See also Redirecting…

The only option is to restart the server to clear the cache. Which is not appropriate.

Is there any other way to bypass the cache, reset it or not save it to the cache in case of an insufficient login?

2

hi @torsten-blazing-hash,

i faced the same problem a while ago my main issue was that the document models were loaded from cache and therefore aligned to the previous roles of my user.

The solution I stick to is to significantly reduce the time-to-live of the restricted-models-cache in a custom hazlecast caches configuration (based on DS config) handed over via application prop spring.hazlecast.config(original DS config you can find in core artifact: hazlecast-caches.xml):

<!--hazelcast-caches.xml-->
<!-- ... -->
<map name="securedModelReadCache">
  <!-- Change time to live to a minute since otherwise runtime role changes on license user will not be reflected when loading secured models from cache -->
  <!-- See A12-14715 for further information -->
  <time-to-live-seconds>60</time-to-live-seconds>
  <eviction size="5000"/>
</map>
<!-- ... -->

Like mentioned in the code comment there is also an a12 ticket reflecting this issue:
A12-14715 - User is not allowed to access models after permission change.
It is marked as candidate for 2024.06 and already in progress, so looking forward to a better solution then decreasing the cache time.

Keep in mind that there are also other caches described that could affect you (for my project for example i did not decrease the time-to-live for model graph which could be necessary if your project rely on that).

3

Thanks, that sounds reasonable. Are there any known impacts on the application? Like on the performance when reading resources?

4

for my project i did not noticed any impact or performance degradation at all :slightly_smiling_face: