Fix authorization handler order in splinterd
The maintenance mode auth handler should be evaluated before the RBAC
handler since it may deny permissions if authorization mode is enabled.
@@ -545,13 +545,6 @@ impl SplinterDaemon {
#[cfg(feature = "authorization-handler-allow-keys")]
authorization_handlers.push(create_allow_keys_authorization_handler(&self.state_dir)?);
- #[cfg(feature = "authorization-handler-rbac")]
- {
- authorization_handlers.push(Box::new(RoleBasedAuthorizationHandler::new(
- store_factory.get_role_based_authorization_store(),
- )));
- }
-
#[cfg(feature = "authorization-handler-maintenance")]
{
let maintenance_mode_auth_handler = MaintenanceModeAuthorizationHandler::new();
@@ -560,6 +553,13 @@ impl SplinterDaemon {
authorization_handlers.push(Box::new(maintenance_mode_auth_handler));
}
+ #[cfg(feature = "authorization-handler-rbac")]
+ {
+ authorization_handlers.push(Box::new(RoleBasedAuthorizationHandler::new(
+ store_factory.get_role_based_authorization_store(),
+ )));
+ }
+
rest_api_builder = rest_api_builder
.with_authorization_handlers(authorization_handlers)
.add_resource(Resource::build("/openapi.yaml").add_method(
