Closed Bug 1436028 Opened 8 years ago Closed 6 years ago

Role expansion in the roles UI can be confusing

Categories

(Taskcluster :: UI, enhancement)

Product:
Taskcluster
Component:
UI
Type:
enhancement
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: pmoore, Unassigned)

Details

Visiting https://tools.taskcluster.net/auth/roles/mozilla-user%3A* we see: RoleId mozilla-user:* Scopes assume:project:taskcluster:tutorial queue:route:notify.email.* Expanded Scopes assume:hook-id:garbage/* assume:hook-id:project-deepspeech/* assume:hook-id:project-gaia/* assume:hook-id:project-releng/misc-third-party-library-alert-service assume:hook-id:project-releng/services-master-* assume:hook-id:project-releng/services-production-* assume:hook-id:project-releng/services-staging-* assume:hook-id:project-rust/* assume:hook-id:project-socorro/* assume:hook-id:tc-hooks-tests/tc-test-hook assume:mozilla-group:scm_level_3 assume:mozilla-user:* assume:project-admin:deepspeech assume:project-admin:gaia assume:project-admin:rust assume:project-admin:socorro assume:project:balrog:admin assume:project:deepspeech:* assume:project:gaia:* assume:project:releng:gecko-win-test-troubleshooter assume:project:releng:services/develop/releng assume:project:releng:services/develop/shipit assume:project:releng:treestatus/sheriff assume:project:rust:* assume:project:shipit:admin assume:project:shipit:user assume:project:socorro:* assume:project:taskcluster:contributor assume:project:taskcluster:diagnostics assume:project:taskcluster:generic-worker-tester assume:project:taskcluster:github assume:project:taskcluster:gps-docker-worker-test-scopes assume:project:taskcluster:index-test-scopes assume:project:taskcluster:mozilla-github-repository assume:project:taskcluster:notify assume:project:taskcluster:tc-hooks-tests assume:project:taskcluster:tutorial assume:project:taskcluster:worker-test-scopes assume:project:testbhearsum-balrog:admin assume:repo:github.com/devtools-html/devtools:* assume:repo:github.com/glandium/git-cinnabar:* assume:repo:github.com/mozilla-releng/services:branch:master assume:repo:github.com/mozilla-releng/services:branch:production assume:repo:github.com/mozilla-releng/services:branch:staging assume:repo:github.com/mozilla/DeepSpeech:* assume:repo:github.com/mozilla/balrog:* assume:repo:github.com/mozilla/loop:* assume:repo:github.com/mozilla/tensorflow:* assume:repo:github.com/ochameau/ff-dt:* assume:repo:github.com/testbhearsum/balrog:* assume:scheduler-id:docker-worker-tests/* assume:scheduler-id:tc-diagnostics/* assume:worker-id:dummy-test-workergroup/dummy-test-worker-id assume:worker-id:test-worker-group/test-worker-id assume:worker-type:dummy-test-provisioner/dummy-test-worker-type assume:worker-type:no-provisioning-nope/dummy-type-* assume:worker-type:test-provisioner/* auth:aws-s3:read-write:test-bucket-for-any-garbage/* auth:azure-table-access:jungle/* auth:azure-table:read-write:jungle/* auth:create-client:project/deepspeech/* auth:create-client:project/gaia/* auth:create-client:project/rust/* auth:create-client:project/socorro/* auth:create-client:project/taskcluster/tc-diagnostics/development/* auth:create-role:hook-id:project-deepspeech/* auth:create-role:hook-id:project-gaia/* auth:create-role:hook-id:project-rust/* auth:create-role:hook-id:project-socorro/* auth:create-role:project:deepspeech:* auth:create-role:project:gaia:* auth:create-role:project:rust:* auth:create-role:project:socorro:* auth:create-role:repo:github.com/glandium/git-cinnabar:* auth:create-role:repo:github.com/mozilla/DeepSpeech:* auth:create-role:repo:github.com/mozilla/balrog:* auth:create-role:repo:github.com/mozilla/tensorflow:* auth:create-role:repo:github.com/testbhearsum/balrog:* auth:delete-client:project/deepspeech/* auth:delete-client:project/gaia/* auth:delete-client:project/rust/* auth:delete-client:project/socorro/* auth:delete-client:project/taskcluster/tc-diagnostics/development/* auth:delete-role:hook-id:project-deepspeech/* auth:delete-role:hook-id:project-gaia/* auth:delete-role:hook-id:project-rust/* auth:delete-role:hook-id:project-socorro/* auth:delete-role:project:deepspeech:* auth:delete-role:project:gaia:* auth:delete-role:project:rust:* auth:delete-role:project:socorro:* auth:delete-role:repo:github.com/glandium/git-cinnabar:* auth:delete-role:repo:github.com/mozilla/DeepSpeech:* auth:delete-role:repo:github.com/mozilla/balrog:* auth:delete-role:repo:github.com/mozilla/tensorflow:* auth:delete-role:repo:github.com/testbhearsum/balrog:* auth:disable-client:project/deepspeech/* auth:disable-client:project/gaia/* auth:disable-client:project/rust/* auth:disable-client:project/socorro/* auth:enable-client:project/deepspeech/* auth:enable-client:project/gaia/* auth:enable-client:project/rust/* auth:enable-client:project/socorro/* auth:reset-access-token:project/deepspeech/* auth:reset-access-token:project/gaia/* auth:reset-access-token:project/rust/* auth:reset-access-token:project/socorro/* auth:sentry:generic-worker auth:sentry:playground auth:sentry:tc-diagnostics auth:sentry:test-dummy-worker auth:statsum:playground auth:statsum:tc-diagnostics auth:statsum:test-dummy-worker auth:update-client:project/deepspeech/* auth:update-client:project/gaia/* auth:update-client:project/rust/* auth:update-client:project/shipit/services/staging auth:update-client:project/socorro/* auth:update-role:hook-id:project-deepspeech/* auth:update-role:hook-id:project-gaia/* auth:update-role:hook-id:project-rust/* auth:update-role:hook-id:project-socorro/* auth:update-role:project:deepspeech:* auth:update-role:project:gaia:* auth:update-role:project:rust:* auth:update-role:project:socorro:* auth:update-role:repo:github.com/glandium/git-cinnabar:* auth:update-role:repo:github.com/mozilla-releng/services:branch:master auth:update-role:repo:github.com/mozilla-releng/services:branch:staging auth:update-role:repo:github.com/mozilla/DeepSpeech:* auth:update-role:repo:github.com/mozilla/balrog:* auth:update-role:repo:github.com/mozilla/tensorflow:* auth:update-role:repo:github.com/testbhearsum/balrog:* auth:update-role:worker-type:aws-provisioner-v1/win* auth:webhooktunnel aws-provisioner:* docker-worker:cache:docker-worker-garbage-caches-* docker-worker:cache:services-production-* docker-worker:cache:services-staging-* docker-worker:cache:shipit-bot-production docker-worker:cache:shipit-bot-staging docker-worker:image:taskclusterprivate/upload_symbols:0.0.3 docker-worker:relengapi-proxy:tooltool.download.internal generic-worker:cache:banana-cache generic-worker:cache:deepspeech-* generic-worker:cache:devtools-app generic-worker:cache:test-modifications generic-worker:cache:unknown-issuer-app-cache generic-worker:os-group:abc generic-worker:os-group:def github:create-comment:devtools-html/devtools github:create-comment:ochameau/ff-dt github:create-status:devtools-html/devtools github:create-status:marco-c/* github:create-status:ochameau/ff-dt hooks:modify-hook:garbage/* hooks:modify-hook:project-deepspeech/* hooks:modify-hook:project-gaia/* hooks:modify-hook:project-releng/misc-third-party-library-alert-service hooks:modify-hook:project-releng/services-master-* hooks:modify-hook:project-releng/services-production-* hooks:modify-hook:project-releng/services-staging-* hooks:modify-hook:project-rust/* hooks:modify-hook:project-socorro/* hooks:trigger-hook:garbage/* hooks:trigger-hook:project-deepspeech/* hooks:trigger-hook:project-gaia/* hooks:trigger-hook:project-releng/misc-third-party-library-alert-service hooks:trigger-hook:project-releng/nightly-fennec/oak hooks:trigger-hook:project-releng/services-master-* hooks:trigger-hook:project-releng/services-production-* hooks:trigger-hook:project-releng/services-staging-* hooks:trigger-hook:project-rust/* hooks:trigger-hook:project-socorro/* index:insert-task:garbage.tc-diagnostics.* index:insert-task:gecko.v2.* index:insert-task:github.glandium.git-cinnabar.* index:insert-task:project.deepspeech.* index:insert-task:project.devtools.* index:insert-task:project.gaia.* index:insert-task:project.rust.* index:insert-task:project.socorro.* notify:email:* notify:irc-channel:* notify:irc-user:* project:deepspeech:* project:gaia:* project:releng:services/releng* project:releng:services/shipit* project:releng:treestatus/recent_changes/revert project:releng:treestatus/trees/update project:relops-hardware-controller:* project:rust:* project:shipit:admin project:shipit:analysis/use project:shipit:bugzilla project:shipit:user project:socorro:* project:taskcluster:tests:tc-hooks:scope/required/for/task/1 purge-cache:aws-provisioner-v1/b2gtest-emulator:level-1-* purge-cache:aws-provisioner-v1/b2gtest-emulator:tooltool-cache purge-cache:aws-provisioner-v1/b2gtest:level-1-* purge-cache:aws-provisioner-v1/b2gtest:tooltool-cache purge-cache:aws-provisioner-v1/balrog:level-1-* purge-cache:aws-provisioner-v1/balrog:tooltool-cache purge-cache:aws-provisioner-v1/cli:level-1-* purge-cache:aws-provisioner-v1/cli:tooltool-cache purge-cache:aws-provisioner-v1/cratertest:level-1-* purge-cache:aws-provisioner-v1/cratertest:tooltool-cache purge-cache:aws-provisioner-v1/dbg-linux32:level-1-* purge-cache:aws-provisioner-v1/dbg-linux32:tooltool-cache purge-cache:aws-provisioner-v1/dbg-linux64:level-1-* purge-cache:aws-provisioner-v1/dbg-linux64:tooltool-cache purge-cache:aws-provisioner-v1/dbg-macosx64:level-1-* purge-cache:aws-provisioner-v1/dbg-macosx64:tooltool-cache purge-cache:aws-provisioner-v1/desktop-test-xlarge:level-1-* purge-cache:aws-provisioner-v1/desktop-test-xlarge:tooltool-cache purge-cache:aws-provisioner-v1/desktop-test:level-1-* purge-cache:aws-provisioner-v1/desktop-test:tooltool-cache purge-cache:aws-provisioner-v1/gecko-decision:level-1-* purge-cache:aws-provisioner-v1/gecko-decision:tooltool-cache purge-cache:aws-provisioner-v1/mulet-debug:level-1-* purge-cache:aws-provisioner-v1/mulet-debug:tooltool-cache purge-cache:aws-provisioner-v1/mulet-opt:level-1-* purge-cache:aws-provisioner-v1/mulet-opt:tooltool-cache purge-cache:aws-provisioner-v1/opt-linux32:level-1-* purge-cache:aws-provisioner-v1/opt-linux32:tooltool-cache purge-cache:aws-provisioner-v1/opt-linux64:level-1-* purge-cache:aws-provisioner-v1/opt-linux64:tooltool-cache purge-cache:aws-provisioner-v1/opt-macosx64:level-1-* purge-cache:aws-provisioner-v1/opt-macosx64:tooltool-cache purge-cache:aws-provisioner-v1/spidermonkey:level-1-* purge-cache:aws-provisioner-v1/spidermonkey:tooltool-cache purge-cache:aws-provisioner-v1/symbol-upload:level-1-* purge-cache:aws-provisioner-v1/symbol-upload:tooltool-cache purge-cache:deepspeech-provisioner/* purge-cache:garbage* purge-cache:verifyprovisioner/verifyworker:verifycache queue:cancel-task queue:cancel-task:* queue:claim-task queue:claim-task:dummy-test-provisioner/dummy-test-worker-type queue:claim-task:test-dummy-provisioner/dummy-worker-* queue:claim-work:deepspeech-provisioner/* queue:claim-work:dummy-test-provisioner/dummy-test-worker-type queue:claim-work:localprovisioner/kats-* queue:claim-work:no-provisioning-nope/* queue:claim-work:test-dummy-provisioner/dummy-worker-* queue:claim-work:test-provisioner/* queue:create-artifact:SampleArtifacts/_/X.txt queue:create-artifact:custom queue:create-artifact:private/dummy-test-provisioner.log queue:create-artifact:public/* queue:create-task:aws-provisioner-v1/b2gtest queue:create-task:aws-provisioner-v1/cratertest queue:create-task:aws-provisioner-v1/deepspeech-* queue:create-task:aws-provisioner-v1/gecko-t-linux-large queue:create-task:aws-provisioner-v1/gecko-t-linux-medium queue:create-task:aws-provisioner-v1/github-worker queue:create-task:aws-provisioner-v1/nss-win2012r2 queue:create-task:aws-provisioner-v1/releng-task queue:create-task:aws-provisioner-v1/rustbuild queue:create-task:aws-provisioner-v1/symbol-upload queue:create-task:aws-provisioner-v1/tutorial queue:create-task:aws-provisioner-v1/win2012r2 queue:create-task:aws-provisioner-v1/win2012r2-mediatests queue:create-task:dummy-test-provisioner/dummy-test-worker-type queue:create-task:high:deepspeech-provisioner/* queue:create-task:high:localprovisioner/kats-* queue:create-task:highest:aws-provisioner-v1/github-worker queue:create-task:highest:aws-provisioner-v1/releng-* queue:create-task:highest:deepspeech-provisioner/* queue:create-task:highest:localprovisioner/kats-* queue:create-task:highest:test-dummy-provisioner/dummy-test-worker-type queue:create-task:highest:test-dummy-provisioner/dummy-worker-packet queue:create-task:localprovisioner/deepspeech-* queue:create-task:localprovisioner/kats-* queue:create-task:low:deepspeech-provisioner/* queue:create-task:low:localprovisioner/kats-* queue:create-task:lowest:aws-provisioner-v1/deepspeech-* queue:create-task:lowest:deepspeech-provisioner/* queue:create-task:lowest:localprovisioner/deepspeech-macos queue:create-task:lowest:localprovisioner/kats-* queue:create-task:lowest:no-provisioning-nope/* queue:create-task:medium:deepspeech-provisioner/* queue:create-task:medium:localprovisioner/kats-* queue:create-task:no-provisioner/test-worker queue:create-task:no-provisioning-nope/dummy-type-* queue:create-task:test-dummy-provisioner/dummy-worker-* queue:create-task:test-provisioner/* queue:create-task:very-high:deepspeech-provisioner/* queue:create-task:very-high:localprovisioner/kats-* queue:create-task:very-low:deepspeech-provisioner/* queue:create-task:very-low:localprovisioner/kats-* queue:declare-provisioner:test-dummy-provisioner#actions queue:define-task:aws-provisioner-v1/b2gtest queue:define-task:test-dummy-provisioner/dummy-worker-* queue:define-task:trink-provisioned/trink-* queue:get-artifact:SampleArtifacts/_/X.txt queue:get-artifact:SampleArtifacts/b/c/d.jpg queue:get-artifact:private/docker-worker/* queue:get-artifact:private/dummy-test-provisioner.log queue:get-artifact:project/deepspeech/* queue:get-artifact:project/gaia/* queue:get-artifact:project/rust/* queue:get-artifact:project/socorro/* queue:get-artifact:public/logs/all_commands.log queue:get-artifact:public/logs/command_000000.log queue:pending-tasks:aws-provisioner-v1/rustbuild queue:poll-task-urls queue:poll-task-urls:test-dummy-provisioner/dummy-worker-* queue:report-task-completed:dummy-test-provisioner/dummy-test-worker-type queue:rerun-task:-/* queue:resolve-task queue:route:crater.* queue:route:dummy-routes.index-testing.* queue:route:garbage.* queue:route:index.garbage.* queue:route:index.github.glandium.git-cinnabar.* queue:route:index.project.balrog.* queue:route:index.project.deepspeech.* queue:route:index.project.devtools.* queue:route:index.project.gaia.* queue:route:index.project.releng.services.requests.master.* queue:route:index.project.releng.services.requests.production.* queue:route:index.project.releng.services.requests.staging.* queue:route:index.project.rust.* queue:route:index.project.socorro.* queue:route:notify.* queue:route:test-notify.* queue:schedule-task queue:schedule-task:task-graph-scheduler/* queue:schedule-task:test-dummy-scheduler/* queue:schedule-task:trink-provisioned/trink-* queue:scheduler-id:- queue:scheduler-id:docker-worker-tests queue:scheduler-id:taskcluster-github queue:task-group-id:-/* queue:task-group-id:test-dummy-scheduler/* queue:worker-id:deepspeech-workers/* queue:worker-id:dummy-test-workergroup/dummy-test-worker-id queue:worker-id:local-worker/kats-* queue:worker-id:random-local-worker/dummy-worker-* queue:worker-id:test-dummy-workers/dummy-worker-* queue:worker-id:test-worker-group/* secrets:get:garbage/* secrets:get:project/deepspeech/* secrets:get:project/gaia/* secrets:get:project/releng/gecko/build/level-1/pocket-api-beta.token secrets:get:project/releng/gecko/build/level-1/pocket-api-nightly.token secrets:get:project/releng/gecko/build/level-1/pocket-api-release.token secrets:get:project/releng/gecko/build/level-2/pocket-api-beta.token secrets:get:project/releng/gecko/build/level-2/pocket-api-nightly.token secrets:get:project/releng/gecko/build/level-2/pocket-api-release.token secrets:get:project/releng/gecko/build/level-3/pocket-api-beta.token secrets:get:project/releng/gecko/build/level-3/pocket-api-nightly.token secrets:get:project/releng/gecko/build/level-3/pocket-api-release.token secrets:get:project/rust/* secrets:get:project/socorro/* secrets:get:project/taskcluster/aws-provisioner-v1/worker-types/ssh-keys/* secrets:get:project/taskcluster/taskcluster-worker/stateless-dns secrets:get:repo:github.com/devtools-html/devtools:branch:master secrets:get:repo:github.com/glandium.git-cinnabar:* secrets:get:repo:github.com/mozilla-releng/OpenCloudConfig:* secrets:get:repo:github.com/mozilla-releng/services:branch:master secrets:get:repo:github.com/mozilla-releng/services:branch:production secrets:get:repo:github.com/mozilla-releng/services:branch:staging secrets:get:repo:github.com/mozilla/balrog:* secrets:get:repo:github.com/mozilla/example-addon-repo:* secrets:get:repo:github.com/ochameau/ff-dt:branch:master secrets:get:repo:github.com/taskcluster/docker-worker:* secrets:get:repo:github.com/testbhearsum/balrog:* secrets:set:garbage/* secrets:set:project/deepspeech/* secrets:set:project/gaia/* secrets:set:project/releng/gecko/build/level-1/pocket-api-beta.token secrets:set:project/releng/gecko/build/level-1/pocket-api-nightly.token secrets:set:project/releng/gecko/build/level-1/pocket-api-release.token secrets:set:project/releng/gecko/build/level-2/pocket-api-beta.token secrets:set:project/releng/gecko/build/level-2/pocket-api-nightly.token secrets:set:project/releng/gecko/build/level-2/pocket-api-release.token secrets:set:project/releng/gecko/build/level-3/pocket-api-beta.token secrets:set:project/releng/gecko/build/level-3/pocket-api-nightly.token secrets:set:project/releng/gecko/build/level-3/pocket-api-release.token secrets:set:project/rust/* secrets:set:project/socorro/* secrets:set:project/taskcluster/aws-provisioner-v1/worker-types/ssh-keys/* secrets:set:repo:github.com/devtools-html/devtools:* secrets:set:repo:github.com/glandium.git-cinnabar:* secrets:set:repo:github.com/mozilla-releng/services:branch:master secrets:set:repo:github.com/mozilla-releng/services:branch:production secrets:set:repo:github.com/mozilla-releng/services:branch:staging secrets:set:repo:github.com/mozilla/balrog:* secrets:set:repo:github.com/mozilla/example-addon-repo:* secrets:set:repo:github.com/ochameau/ff-dt:* secrets:set:repo:github.com/testbhearsum/balrog:* assume:project:taskcluster:tutorial should only expand to: queue:create-task:aws-provisioner-v1/tutorial queue:route:index.garbage.* secrets:get:garbage/* secrets:set:garbage/* However, this list of scopes is considerably larger than just these four scopes, so I think we may have either a UI bug or an auth bug.
I suspect this is a UI issue. Probably this long list is the expanded scopes for the scope assume:mozilla-user:*, i.e. containing the scopes of any role that matches mozilla-user:*. At best, this is highly misleading.
(In reply to Pete Moore [:pmoore][:pete] from comment #1) > I suspect this is a UI issue. Probably this long list is the expanded scopes > for the scope assume:mozilla-user:*, i.e. containing the scopes of any role > that matches mozilla-user:*. > > At best, this is highly misleading. It is misleading, because when one sees a list of scopes, and then expanded scopes, one expects to see the result of recursively expanding `assume:<role>` scopes into the set of scopes of role <role>, i.e. in this case one would expect the expanded set of scopes to be: queue:create-task:aws-provisioner-v1/tutorial queue:route:index.garbage.* secrets:get:garbage/* secrets:set:garbage/*
The expandedScopes section of a role display is the expansion of ['assume:<roleId>']. When the roleId ends with a *, that * matches all longer roles. Depending on what you're looking for, that's sometimes expected ("what happens if I assume this role") Seeing the opposite (the expansion of role.scopes) can also be misleading. We chose the option with more scopes, on the basis that it suggests more scopes would be granted, rather than fewer. It's even more confusing with parameterized roles, and this particular expansion does a better job of representing the somewhat surprising behavior there. Take, for example, login-identity:* auth:create-client:<..>/* Then ['assume:login-identity:dustin'] will expand to include ['auth:create-client:dustin/*']. But ['assume:login-identity:*'] will expand to include ['auth:create-client:*'] *NOT* as you might expect ['auth:create-client:*/*']. There's room for some carefully thought-out modifications to the UI here -- perhaps special-casing the case of roles with a trailing '*' to show both potential expansions, and for roles with a trailing '*' and '<..>' in the scopes to highlight the special case described above? That would be a tools modification.
Group: taskcluster-security
Component: Authentication → Tools
Summary: Scope overassignment(???) → Role expansion in the roles UI can be confusing
Commit pushed to master at https://github.com/taskcluster/taskcluster-tools https://github.com/taskcluster/taskcluster-tools/commit/7107c9f4a3ed87cfac258d066336beaec75b8cd9 Bug 1436028 - do not show expandedScopes for * roles These expanded scopes confuse people all the time. In the absence of a better solution, let's just hide them entirely.
Thanks Dustin. I think we could augment the current view to show: 1) Scopes 2) Expanded Scopes 3) Inherited Scopes 1) and 2) are already implemented, and need no explanation here. 3) would show the scopes that any role would implicitly inherit, whose name matches the role name. As a consequence, this would be an empty list if the role does not end in '*'. Like you say, both sets of data represent relevant information, so I think by distinguishing the terms "expanded scopes" and "inherited scopes" we have a way to represent both sets of data.
Can you show how (2) and (3) are calculated?
Flags: needinfo?(pmoore)
I will try to look at this this week.
Assigning to pete since he's looking at it.
Assignee: nobody → pmoore
Component: Tools → UI and Tools
Flags: needinfo?(pmoore)

Pete: are you still working on this? Should it go back in the pool?

Flags: needinfo?(pmoore)

(In reply to Dustin J. Mitchell [:dustin] (he/him) from comment #7)

Can you show how (2) and (3) are calculated?

(2) is Expanded Scopes, and would be calculated as it is already calculated now (no change here), i.e. the list of scopes represented by assume:<role> where <role> is the role being displayed.

(3) would be empty if the role name does not end with *. If the role name does end with *, it would be the union of the expanded scopes of each scope it directly contains.

Flags: needinfo?(pmoore)
Assignee: pmoore → nobody

We have a Scope Explorer that accomplishes some of this now. Realistically speaking, we're not going to get to this. Feel free to re-open if you want to take this on.

Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.