1221617 - when validating temp creds, take the intersection of issuer's scopes, ext.scopes

Status: RESOLVED INVALID

(Taskcluster :: Services, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Currently, if you create temporary scopes but then your own scopes change for some reason (which is not unusual, as we adjust roles to model what's going on in production) and the new scopes do not satisfy tmp.scopes, tmp becomes completely invalid.  This is a big problem if tmp.scopes was created with client.expandScopes(), but can be a problem even without that (if client.scopes is modified).

A potential fix is to just strip the un-satisfied scopes from the scopelist returned from authenticateHawk, rather than returning failure.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

I've been convinced this is a bad idea, and that most temporary credentials will have .scopes containing some set of roles that's also associated with the parent clientId, so as those roles change, the temp creds expanded scopes will change as well.