"runas" like privilege escalation in Resource Actions

[Bernd Johannes]

Hi EDG enthusiasts,

my understanding is, that a resource action (explore / modify) is executed with the access rights / roles of the executing user (which is good).

Is there a way, to call a function from within the resource action script that itself runs within another user context (basically a static "runas" assignment on function or hosting collection level).

Use case is, that we want to provide an impact analysis report, where the changes planned in a workflow are checked against existing consumers of the collection.

To be sure, that the report catches all instances of references to the changed assets, it needs to run with global read privileges.

However, at the moment I found no approach, to achieve this with ADS scripts.

Any hint would be welcome.

Greetings

Bernd

[Holger Knublauch]

On Feb 17, 2025, at 17:35, Bernd Johannes <bjo...@gmail.com> wrote:

Hi EDG enthusiasts,

my understanding is, that a resource action (explore / modify) is executed with the access rights / roles of the executing user (which is good).

Is there a way, to call a function from within the resource action script that itself runs within another user context (basically a static "runas" assignment on function or hosting collection level).

Use case is, that we want to provide an impact analysis report, where the changes planned in a workflow are checked against existing consumers of the collection.

To be sure, that the report catches all instances of references to the changed assets, it needs to run with global read privileges.

I went through our API but cannot find a function that would be exposed to ADS to switch users.

And even if we were to allow this, it would be a violation of the security model, esp if you would want to give that user global read privileges. Only admins/power users can do that, so I am afraid only those users should be able to execute your script actions.

I hope this makes sense.

Holger

However, at the moment I found no approach, to achieve this with ADS scripts.

Any hint would be welcome.

Greetings

Bernd

--
The topics of this mailing list include TopBraid EDG and related technologies such as SHACL.
To post to this group, send email to topbrai...@googlegroups.com
---
You received this message because you are subscribed to the Google Groups "TopBraid Suite Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to topbraid-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/topbraid-users/a7542fcd-05f1-4190-9fae-455240a90235n%40googlegroups.com.