fix: allow org admins to bypass other checks in MLDES authentication (#…

…1072)
determined-ai · Nov 29, 2023 · 5b330f2 · 5b330f2
1 parent 24c5efc
commit 5b330f2
Showing 1 changed file with 13 additions and 9 deletions.
diff --git a/master/internal/user/external_users.go b/master/internal/user/external_users.go
@@ -48,17 +48,21 @@ func ByExternalToken(tokenText string,
 	if !ok || orgRoles.Role == model.NoRole {
 		return nil, nil, db.ErrNotFound
 	}
-	clusterAccess, ok := orgRoles.ClusterRoles[ext.ClusterID]
-	if ok {
-		if clusterAccess == model.NoRole {
-			return nil, nil, db.ErrNotFound
-		}
-		isAdmin = clusterAccess == model.AdminRole
+	if orgRoles.Role == model.AdminRole {
+		isAdmin = true
 	} else {
-		if orgRoles.DefaultClusterRole == model.NoRole {
-			return nil, nil, db.ErrNotFound
+		clusterAccess, ok := orgRoles.ClusterRoles[ext.ClusterID]
+		if ok {
+			if clusterAccess == model.NoRole {
+				return nil, nil, db.ErrNotFound
+			}
+			isAdmin = clusterAccess == model.AdminRole
+		} else {
+			if orgRoles.DefaultClusterRole == model.NoRole {
+				return nil, nil, db.ErrNotFound
+			}
+			isAdmin = orgRoles.DefaultClusterRole == model.AdminRole
 		}
-		isAdmin = orgRoles.DefaultClusterRole == model.AdminRole
 	}
 
 	scimLock.Lock()