authorize tag not looking at certain roles

[adefreitas]

We just upgraded to 3.7 and are having problems with our authorize tags.  They work fine for the root roles but for any external roles that are specific to organization they no longer work.  We are not getting an error message, but the pages act as if the user is not assigned a role with that name.

For example, in homeForNonAdmin.jsp (code below),  If the user has a role with this name defined at the root they are able to see the button, but if they have one defined for the organization they are not.

Thanks,
Andrea

Code:

<%@ taglib uri="http://www.springframework.org/security/tags" prefix="authz"%><authz:authorize ifAnyGranted="ROLE_REPORT_CREATOR"><tr><td width="100%" ><table class=homebuttonselector border=0 cellpadding=0 cellspacing=0 id='createReport' onmouseover=buttonOver(this) onmouseout=buttonOut(this) onmousedown=buttonDown(this) onmouseup=buttonUp()><tr ><td width="125"> </td><td width="125"><img src="images/create.gif"></td><td colspan="2" id="createReportText" class="homemenutext" valign="middle"><span id="createReportKeyword" class="homemenukeyword"><spring:message code="NAV_103_HOME_CREATE_KEY"/></span> <spring:message code="NAV_104_HOME_CREATE_TEXT"/></td></tr></table></td></tr></authz:authorize>

[swood]

Was this working in JasperServer 3.5? If it was, this is a bug.

 

Sherman
Jaspersoft

[adefreitas]

Yes, it did work in 3.5. 

We found that the getPrincipalAuthorities() function called in the AuthorizeTag class is now pulling TenantAwareGrantedAuthorities instead of just GrantedAuthorities.  This is appending the tenant id to the role/ authority.  We were able to accomodate this in the jsp pages by using a dynamic string in ifAnyGranted="", but we are unable to do the same thing for the role configuration in JI-menu.xml.

Ideas?  If this is a bug any idea of work arounds or available patches?

Thanks,
Andrea

[swood]

You are the first to hit this. Looks like we need our own version of the Authorize tag and an updated menu determination method. Please raise a bug.

 

 

Sherman

Jaspersoft

[bcarlson]

 We have raised a bug with JasperSoft Support.

 

Thanks!