Repository: privacyidea/privacyidea

Issue:
Tokenimport does not work without policies
privacyIDEA 3.3

It seems like token import does not work when no admin policies are defined. The admin gets the error message, "Admin actions are defined, but you are not allowed to upload token files.".


Discussion:
The problem is, that the policy check is missing the scope. Thus this fails, if there are *other* policies in *other* scopes, since the policy_at_all will return the other policies.

Resolving patch:
diff --git a/privacyidea/api/lib/prepolicy.py b/privacyidea/api/lib/prepolicy.py
--- a/privacyidea/api/lib/prepolicy.py
+++ b/privacyidea/api/lib/prepolicy.py
@@ -1017,12 +1017,14 @@ def check_token_upload(request=None, action=None):
     upload_allowed = True
     if tokenrealms:
         for trealm in tokenrealms.split(","):
-            if not Match.generic(g, action=ACTION.IMPORT, adminuser=g.logged_in_user.get("username"),
-                                           adminrealm=g.logged_in_user.get("realm"), realm=trealm).allowed():
+            if not Match.generic(g, scope=SCOPE.ADMIN, action=ACTION.IMPORT,
+                                 adminuser=g.logged_in_user.get("username"),
+                                 adminrealm=g.logged_in_user.get("realm"), realm=trealm).allowed():
                 upload_allowed = False
     else:
-        upload_allowed = Match.generic(g, action=ACTION.IMPORT, adminuser=g.logged_in_user.get("username"),
-                                        adminrealm=g.logged_in_user.get("realm")).allowed()
+        upload_allowed = Match.generic(g, scope=SCOPE.ADMIN, action=ACTION.IMPORT,
+                                       adminuser=g.logged_in_user.get("username"),
+                                       adminrealm=g.logged_in_user.get("realm")).allowed()
     if not upload_allowed:
         raise PolicyError("Admin actions are defined, but you are not allowed to upload token files.")
     return True


Test patch:
diff --git a/tests/test_api_token.py b/tests/test_api_token.py
--- a/tests/test_api_token.py
+++ b/tests/test_api_token.py
@@ -833,10 +833,13 @@ def test_10_set_token_realms(self):
             self.assertTrue(token.get("realms") == ["realm1"], token)
 
     def test_11_load_tokens(self):
+        # Set dummy policy to verify faulty behaviour with #2209
+        set_policy("dumm01", scope=SCOPE.USER, action=ACTION.DISABLE)
         # Load OATH CSV
         with self.app.test_request_context('/token/load/import.oath',
                                             method="POST",
                                             data={"type": "oathcsv",
+                                                  "tokenrealms": self.realm1,
                                                   "file": (IMPORTFILE,
                                                            "import.oath")},
                                             headers={'Authorization': self.at}):
@@ -848,6 +851,7 @@ def test_11_load_tokens(self):
         # check for a successful audit entry
         entry = self.find_most_recent_audit_entry(action='*/token/load/*')
         self.assertEqual(entry['success'], 1, entry)
+        delete_policy("dumm01")
 
         # Load GPG encrypted OATH CSV
         with self.app.test_request_context('/token/load/import.oath.asc',