Description

When configuring multi-tenancy using kebab case, e.g. camunda.security.multi-tenancy.checks-enabled, then tenancy checks are not applied to the Operate and Tasklist V1/internal APIs. Since the UIs still use the V1 APIs in some areas, data becomes visible there, too.

Steps to reproduce

1. Configure an application property to enable tenant checks as kebab-case, i.e. camunda.security.multi-tenancy.checks-enabled: true
2. Start the application
3. Create two tenants with one user each
4. Deploy a process model for each user
5. Log in with one of the users to Operate
6. Go to Operate at http://localhost:8080/operate/processes?tenant=all and check which processes are visible

Current behavior

• Both deployed processes are visible (since the internal API /api/processes/grouped is returning both)

Expected behavior

• Only the process to which the user has access to is displayed

Environment

SM

Version

• 8.8.0-alpha7 and later

Rootcause

The tenant access provider is conditionally created, based on an @ConditionalOnProperty annotation. This seems to be case sensitive.

Solution ideas

• Rewrite the condition into a programmatic check that takes care of both cases (or potentially even just use the configuration Java class to access the property value, if that is technicall possible)
• Consider checking the codebase for other occurrences of this pattern

Dev -> QA handover

• Resources:
• Versions to validate:
• Release version (in which version this feature will be released):

Links

• Slack discussion