https://descope.com logo
Join Slack
Powered by
We see a problem that started recently, the roles ...
# ask-a-descoper
s
We see a problem that started recently, the roles returned in the 
v1/mgmt/role/all?tenant
endpoint are not all the roles that are assigned to a tenant Can someone from the team jump on a call to quickly debug that togetheR?
I have opened a ticket as well with more details if anyone from descope sees that, please be in touch with me ASAP TKT-1077
@Gilad Shriki @Reuven Zabirov @Meir Wahnon
m
looping in @Chris Carper and @Nick Rodriguez here
s
LMK if you can jump on a zoom call
n
Answering support ticket in DevRev. I am unavailable for a call at this time, but will try to make some time later today. CC:@Michael Rimboim if you're free at any point as well
m
@Sagi Haas I can hop on a call in 5 minutes if you are free.
s
Let's do it
Send zoom here once you're already?
👍 1
I have sent a link
in private
m
Joining
@Sagi Haas After further reviewing this is expected behavior. The way the widget and search works, it will only display default roles or roles that admin has the same permissions as. Meaning if role 
Viewer
has permission 
view
but the tenant admin has no roles with that same permission it will not show up for them. So for your use case you should create a role that has all the same permissions as you custom role and then assign it to the user. We have some examples and a guide regarding this exact topic here.
s
but it wasn't like that a few days ago
there was a breaking changed that introduced this problem
m
Looping in @Doron Sharon here. Is it possible that the tenant admin user you are using is different from the ones the succesful customers use? Can we check some of the tenant admins for the customers that didn't have problems and see what roles they have vs ones with issues.
s
all our tenants are affected
I have logged in with different users to our own tenant, it doesn't change the result calling 
v1/mgmt/role/all?tenant={TENANT}
just omits the 3 roles that I showed you before
m
Right but the Api works based off the refresh token so if you call it from Curl it won't be a good comparison. Can you try adding a role to your tenant admin user that has same permission as viewer, does the role show up now?
s
1 min I'll check
yep it works, i makes the other roles appear as well
I guess it is not a problem on our end...
custom roles just doesn't appear unless you are assigned at least 1 custom role....
m
It matters the permission not the custom roles, so as long as tenant admin in total has all the permission that custom roles have he can see them. If one of the custom roles has a permission not assigned to tenant admin user that role will not show up for him to prevent escalating privileges.
s
The 
Admin
Role that all the relevant users are assigned to has 
*
shouldn't it cover all of permissions whatsoever?
m
Can you send screenshot?
s
Sure, sending in private
m
I see, I don't believe we support star notation, I would add any relevant permissions that are missing there.
s
I will take it with the team tomorrow, please re-check yourselves as well, seems like we can figure out a solution on our end according to what we have learned today, but changing the behaviour our of a sudden is really problematic, we need to understand how to avoid that in the future
*out of a sudden
m
Hi Sagi, checked with the team and there has been no change to the feature recently. Further more we checked and this behavior has existed for some time now. I would check which users cannot see the roles and across which tenants and then see if they have the necessary roles.
s
Thank you for the update @Michael Rimboim, we solved that internally in the same way you suggested, currently it all seems ok again
2 Views
Open in Slack
PreviousNext
Powered by