rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce owner-only member removal and ownership grants via policy

Browse Source 
An organization ADMIN could hard-remove members, including OWNERs, because
removeUser (connect and MCP) only checked the weaker iam:membership-profile:delete
gate. Authorize the owner-only iam:membership:delete instead, and expose the
source attribute on MembershipProfile so the owner grant's non-SCIM condition
can match.

Consolidate ownership-grant authorization into policy for both createUser and
updateMembership: each resolver passes the requested role as a target_role
attribute and ADMIN is denied granting ownership via deny-create-owner /
deny-promote-owner. target_role is distinct from resource.role, which is the
target's current role and guards editing existing owners. With no callers left,
the iam:membership-role:set-owner action (grant and OAuth2 scope) is removed.

Also pass the authorized scope through to the RemoveUser/CreateUser services,
gate the console Remove action on iam:membership:delete, and add regression
tests plus a changelog entry.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>
This commit is contained in:
Sacha Al Himdani
2026-07-06 16:21:51 +02:00
parent ddfabc5940
commit ff9cb881e8
13 changed files with 133 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/iam/iam_policies.go
View File

@@ -183,11 +183,6 @@ var IAMOwnerPolicy = policy.NewPolicy(
policy.NotEquals("resource.source", "SCIM"),
),
// Can set other members OWNER
policy.Allow(ActionMembershipRoleSetOwner).
WithSID("membership-role-owner-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")),
// Full access to membership profiles (scoped to own organization)
policy.Allow(
ActionMembershipProfileGet,
@@ -318,6 +313,15 @@ var IAMAdminPolicy = policy.NewPolicy(
policy.Deny(ActionMembershipDelete).
WithSID("deny-remove-member"),
// Cannot grant ownership, whether by creating an OWNER member or promoting an
// existing member to OWNER (only owner can grant ownership)
policy.Deny(ActionMembershipProfileCreate).
WithSID("deny-create-owner").
When(policy.Equals("resource.target_role", "OWNER")),
policy.Deny(ActionMembershipUpdate).
WithSID("deny-promote-owner").
When(policy.Equals("resource.target_role", "OWNER")),
// Cannot manage SAML configurations (only owner can)
policy.Deny(
ActionSAMLConfigurationCreate,