Bug 1062181

Summary: Different scope of authorizations should have different permissions
Product: OpenShift Online Reporter: Oleg Fayans <ofayans>
Component: MasterAssignee: Clayton Coleman <ccoleman>
Status: CLOSED WORKSFORME QA Contact: libra bugs <libra-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 1.xCC: amarecek, dmcphers
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-02-07 16:55:09 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Oleg Fayans 2014-02-06 12:11:42 UTC 
Description of problem:
When I create a token with "read" scope and try to use it to create an app, I succeed, while should not.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. rhc authorization add --scopes read --note canread -l ofayans -p 'redhat'

2. rhc authorization-list -l ofayans -p redhat | awk '/Token:/ {print $2}' # To get the token Id to put in the curl request as Authorization Bearer.

3. curl -k -X POST -H 'Accept: application/xml' -H "Authorization: Bearer 61abbca893d3e38b8cd7831851b336c4f50851570102f2d666e0009806dfcc9a"
 https://$OPENSHIFT_BROKER/broker/rest/domains/mydomain/applications -d name=app1 -d cartridge=php-5.3



Actual results:
The last step passes 

Expected results:
The last step should fail 

Additional info:
Comment 1 Clayton Coleman 2014-02-07 16:55:09 UTC 
You are probably getting two authorizations and you're using the first one.  I can't recreate this and the code hasn't changed:

curl -X POST -d name=foo -d cartridges=php-5.3 -k https://localhost/broker/rest/applications -H "Authorization: Bearer 3a4e6f2ad238098e5d4ff1d7b6896d7fcfe67687b16e4135268f33040d20cc2f"
{"api_version":1.6,"data":null,"messages":[{"exit_code":1,"field":null,"index":null,"severity":"error","text":"This action is not allowed with your current authorization."}],"status":"forbidden","supported_api_versions":[1.0,1.1,1.2,1.3,1.4,1.5,1.6],"type":null,"version":"1.6"}