#1446
Issues/hoophq/hoop/#1446

[Question]: Security. Problems with access request rules. Maybe it is a bug

Openqwerty1q2wopened 5mo ago

Question Type

How to use

Your Question

Hello! I try to use new access request rules and have one big problem. Could you please help me?

Context

version 1.67.0

What have you tried?

No response

Code Example

undefined

Related Issues or Documentation

No response

Additional Information

No response

Search

  • I have searched the existing issues and discussions

Code of Conduct

  • I agree to follow this project's Code of Conduct

Activity

8
rogefm5mo ago

Hi! Thank you for opening the issue. Have you tried opening the connection via the web app? Where are you having this problem?

qwerty1q2w5mo ago

I try to use the same access rule in web with JIT and command type and in this case I don't have aproval requests for both of them. User just connects to servers in web terminal. When I had access rules in resource settings I didn't have such issues. I try to connect to PostgreSQL and ClickHouse via http proxy

qwerty1q2w5mo ago

Looks like I should create 2 access request rules with 2 types (command and JIT) for one resource just to have JIT. Just try to create access request rule with JIT type and run hoop connect dbname without flag -d. Is it expected behavior?

qwerty1q2w5mo ago

Hi! Is this PR about this bug?

rogefm5mo ago

Hi @qwerty1q2w, we've started working on a fix for this bug and should have an update rolling out soon. I'll keep you posted on the progress!

yhefamly4mo ago

Hi @qwerty1q2w, we've started working on a fix for this bug and should have an update rolling out soon. I'll keep you posted on the progress!

Hello @rogefm, is there any ETA for a fix?

I'm evaluating hoop for my employer and this significant issue is blocking me from giving a recommendation as I can't test our most critical flows.

rogefm3mo ago

Hi @qwerty1q2w and @yhefamly. Everything is working as expected.

We took a bit longer to get back to you because we were reviewing the flow internally with our design and product teams to make sure the behavior was correct.

At this point, the current behavior is expected: if you want to use both command-based review and JIT on the same connection, you must create two separate rules.

We are designing a better UX for this flow, but for now we will keep the current behavior.

Sorry for the delay, and thanks for your patience. If you guys have any other questions, please let me know.

qwerty1q2w3mo ago

Hi @rogefm! I have explained little bit another scenario but ok, my issue was partially fixed here - https://github.com/hoophq/hoop/pull/1461 and will be fixed fully here - https://github.com/hoophq/hoop/issues/1468 I hope:)