{"action":"created","issue":{"url":"https://api.github.com/repos/ging/fiware-idm/issues/82","repository_url":"https://api.github.com/repos/ging/fiware-idm","labels_url":"https://api.github.com/repos/ging/fiware-idm/issues/82/labels{/name}","comments_url":"https://api.github.com/repos/ging/fiware-idm/issues/82/comments","events_url":"https://api.github.com/repos/ging/fiware-idm/issues/82/events","html_url":"https://github.com/ging/fiware-idm/issues/82","id":227284032,"number":82,"title":"Unauthorized users are allowed","user":{"login":"dcalvoalonso","id":11388886,"avatar_url":"https://avatars3.githubusercontent.com/u/11388886?v=4","gravatar_id":"","url":"https://api.github.com/users/dcalvoalonso","html_url":"https://github.com/dcalvoalonso","followers_url":"https://api.github.com/users/dcalvoalonso/followers","following_url":"https://api.github.com/users/dcalvoalonso/following{/other_user}","gists_url":"https://api.github.com/users/dcalvoalonso/gists{/gist_id}","starred_url":"https://api.github.com/users/dcalvoalonso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcalvoalonso/subscriptions","organizations_url":"https://api.github.com/users/dcalvoalonso/orgs","repos_url":"https://api.github.com/users/dcalvoalonso/repos","events_url":"https://api.github.com/users/dcalvoalonso/events{/privacy}","received_events_url":"https://api.github.com/users/dcalvoalonso/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-05-09T08:11:26Z","updated_at":"2017-09-01T07:27:23Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nI am trying to use FIWARE security Generic Enablers: PEP Proxy, IDM KeyRock and AuthZForce. Specifically, I am using the instances available to trial users in the url https://account.lab.fiware.org.\r\n\r\nMy problem is related with level 1 of authorization. I have configured PEP proxy to check permissions using AuthZForce as you can see below:\r\n```\r\nconfig.azf = {\r\n        enabled: true,\r\n        protocol: 'https',\r\n    host: 'auth.lab.fiware.org',\r\n    port: 6019,\r\n    custom_policy: undefined // use undefined to default policy checks (HTTP verb + path).\r\n};\r\n```\r\nMy application only has an authorized user. When I send requests to PEP proxy with an authorized user’s token, everything goes OK:\r\n\r\n```\r\n2017-05-09 08:56:29.958  - INFO: AZF-Client - Checking authorization to roles [ '106' ] to do  GET  on   and app  43bb03d87eb742918aaef19fcd41a002\r\n2017-05-09 08:56:29.963  - INFO: AZF-Client - Checking auth with AZF...\r\n2017-05-09 08:56:30.388  - INFO: Root - Access-token OK. Redirecting to app...\r\n```\r\n\r\nNevertheless, if I use a token for an unauthorized user, the result is the same:\r\n\r\n```\r\n2017-05-09 08:58:09.501  - INFO: AZF-Client - Checking authorization to roles [] to do  GET  on   and app  43bb03d87eb742918aaef19fcd41a002\r\n2017-05-09 08:58:09.502  - INFO: AZF-Client - Checking auth with AZF...\r\n2017-05-09 08:58:09.876  - INFO: Root - Access-token OK. Redirecting to app...\r\n```\r\n\r\nAs you can see in the output of PEP Proxy, the user does not have a role in the app but the request is approved.\r\n"},"comment":{"url":"https://api.github.com/repos/ging/fiware-idm/issues/comments/326510364","html_url":"https://github.com/ging/fiware-idm/issues/82#issuecomment-326510364","issue_url":"https://api.github.com/repos/ging/fiware-idm/issues/82","id":326510364,"user":{"login":"dcalvoalonso","id":11388886,"avatar_url":"https://avatars3.githubusercontent.com/u/11388886?v=4","gravatar_id":"","url":"https://api.github.com/users/dcalvoalonso","html_url":"https://github.com/dcalvoalonso","followers_url":"https://api.github.com/users/dcalvoalonso/followers","following_url":"https://api.github.com/users/dcalvoalonso/following{/other_user}","gists_url":"https://api.github.com/users/dcalvoalonso/gists{/gist_id}","starred_url":"https://api.github.com/users/dcalvoalonso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcalvoalonso/subscriptions","organizations_url":"https://api.github.com/users/dcalvoalonso/orgs","repos_url":"https://api.github.com/users/dcalvoalonso/repos","events_url":"https://api.github.com/users/dcalvoalonso/events{/privacy}","received_events_url":"https://api.github.com/users/dcalvoalonso/received_events","type":"User","site_admin":false},"created_at":"2017-09-01T07:27:23Z","updated_at":"2017-09-01T07:27:23Z","author_association":"NONE","body":"Is there any news on these? I have done another attempt and I have exactly the same problem.\r\n\r\nPlease find below the output of PEP Proxy with DEBUG level:\r\n\r\n``\r\n2017-09-01 07:15:34.654  - INFO: AZF-Client - Checking authorization to roles [] to do  GET  on  api/VehicleOwner and app  43bb03d87eb742918aaef19fcd41a002\r\n2017-09-01 07:15:34.655  - DEBUG: AZF-Client - XML:  <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?><Request xmlns=\"urn:oasis:names:tc:xacml:3.0:core:schema:wd-17\" CombinedDecision=\"false\" ReturnPolicyIdList=\"false\"><Attributes Category=\"urn:oasis:names:tc:xacml:1.0:subject-category:access-subject\"></Attributes><Attributes Category=\"urn:oasis:names:tc:xacml:3.0:attribute-category:resource\"><Attribute AttributeId=\"urn:oasis:names:tc:xacml:1.0:resource:resource-id\" IncludeInResult=\"false\"><AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">43bb03d87eb742918aaef19fcd41a002</AttributeValue></Attribute><Attribute AttributeId=\"urn:thales:xacml:2.0:resource:sub-resource-id\" IncludeInResult=\"false\"><AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">api/VehicleOwner</AttributeValue></Attribute></Attributes><Attributes Category=\"urn:oasis:names:tc:xacml:3.0:attribute-category:action\"><Attribute AttributeId=\"urn:oasis:names:tc:xacml:1.0:action:action-id\" IncludeInResult=\"false\"><AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">GET</AttributeValue></Attribute></Attributes><Attributes Category=\"urn:oasis:names:tc:xacml:3.0:attribute-category:environment\"></Attributes></Request>\r\n2017-09-01 07:15:34.655  - INFO: AZF-Client - Checking auth with AZF...\r\n2017-09-01 07:15:34.656  - DEBUG: HTTP-Client - Sending  POST  to: https://auth.lab.fiware.org:6019/authzforce-ce/domains/PbrqJjFvEeeI7FJUADLrRg/pdp\r\n2017-09-01 07:15:34.657  - DEBUG: HTTP-Client -  Headers:  { 'X-Auth-Token': 'XlSXY5qUZhKpCJalLM8GhpFpmvhxxt',\r\n  Accept: 'application/xml',\r\n  'Content-Type': 'application/xml' }\r\n2017-09-01 07:15:34.657  - DEBUG: HTTP-Client -  Body:  <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?><Request xmlns=\"urn:oasis:names:tc:xacml:3.0:core:schema:wd-17\" CombinedDecision=\"false\" ReturnPolicyIdList=\"false\"><Attributes Category=\"urn:oasis:names:tc:xacml:1.0:subject-category:access-subject\"></Attributes><Attributes Category=\"urn:oasis:names:tc:xacml:3.0:attribute-category:resource\"><Attribute AttributeId=\"urn:oasis:names:tc:xacml:1.0:resource:resource-id\" IncludeInResult=\"false\"><AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">43bb03d87eb742918aaef19fcd41a002</AttributeValue></Attribute><Attribute AttributeId=\"urn:thales:xacml:2.0:resource:sub-resource-id\" IncludeInResult=\"false\"><AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">api/VehicleOwner</AttributeValue></Attribute></Attributes><Attributes Category=\"urn:oasis:names:tc:xacml:3.0:attribute-category:action\"><Attribute AttributeId=\"urn:oasis:names:tc:xacml:1.0:action:action-id\" IncludeInResult=\"false\"><AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">GET</AttributeValue></Attribute></Attributes><Attributes Category=\"urn:oasis:names:tc:xacml:3.0:attribute-category:environment\"></Attributes></Request>\r\n2017-09-01 07:15:34.941  - DEBUG: AZF-Client - AZF response status:  200\r\n2017-09-01 07:15:34.941  - DEBUG: AZF-Client - AZF response:  <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?><ns5:Response xmlns:ns2=\"http://authzforce.github.io/rest-api-model/xmlns/authz/5\" xmlns:ns3=\"http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6\" xmlns:ns4=\"http://authzforce.github.io/core/xmlns/pdp/3.6\" xmlns:ns5=\"urn:oasis:names:tc:xacml:3.0:core:schema:wd-17\" xmlns:ns6=\"http://www.w3.org/2005/Atom\"><ns5:Result><ns5:Decision>Permit</ns5:Decision></ns5:Result></ns5:Response>\r\n2017-09-01 07:15:34.961  - DEBUG: AZF-Client - AZF response parsing result (JSON):  { Response: \r\n   { '$': \r\n      { 'xmlns:ns2': 'http://authzforce.github.io/rest-api-model/xmlns/authz/5',\r\n        'xmlns:ns3': 'http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6',\r\n        'xmlns:ns4': 'http://authzforce.github.io/core/xmlns/pdp/3.6',\r\n        'xmlns:ns5': 'urn:oasis:names:tc:xacml:3.0:core:schema:wd-17',\r\n        'xmlns:ns6': 'http://www.w3.org/2005/Atom' },\r\n     Result: [ [Object] ] } }\r\n2017-09-01 07:15:34.963  - DEBUG: AZF-Client - AZF response parsing error ('null' means no error):  null\r\n2017-09-01 07:15:34.966  - DEBUG: AZF-Client - Decision:  Permit\r\n2017-09-01 07:15:34.967  - INFO: Root - Access-token OK. Redirecting to app...\r\n2017-09-01 07:15:34.976  - DEBUG: HTTP-Client - Sending  GET  to: https://automat-marketplace.atosresearch.eu:1337/api/VehicleOwner\r\n"}}
{"actor":{"display_login":"dcalvoalonso"}}