Repository: privacyidea/privacyidea

Issue:
add_user_in_response does not honor the realm of a user
When using the authorization polices ``add_user_in_response``  and ``add_resolver_in_response`` for some reason the realm is not evaluated.

This happens here
https://github.com/privacyidea/privacyidea/blob/master/privacyidea/api/lib/postpolicy.py#L332

``Match.action_only`` does not evaluate the user realm or user name. It is not clear, if there is a reason for not doing this.

Otherwise we could use ``Match.user`` instead. This way the ``add_*_in_response`` would also evaluate the user/realm.

Need to check first.


Discussion:
Try to understand what this tests does in test_api_lib_policy.py:
`` def test_04_add_user_in_response(self):``.

This tests the decorator ``def add_user_detail_to_response(request, response):`` in api/lib/postpolicy.py.

Resolving patch:
diff --git a/privacyidea/api/lib/postpolicy.py b/privacyidea/api/lib/postpolicy.py
--- a/privacyidea/api/lib/postpolicy.py
+++ b/privacyidea/api/lib/postpolicy.py
@@ -329,7 +329,7 @@ def add_user_detail_to_response(request, response):
     content = response.json
 
     # Check for ADD USER IN RESPONSE
-    detail_pol = Match.action_only(g, scope=SCOPE.AUTHZ, action=ACTION.ADDUSERINRESPONSE)\
+    detail_pol = Match.user(g, scope=SCOPE.AUTHZ, action=ACTION.ADDUSERINRESPONSE, user_object=request.User)\
         .policies(write_to_audit_log=False)
     if detail_pol and content.get("result", {}).get("value") and request.User:
         # The policy was set, we need to add the user
@@ -343,7 +343,7 @@ def add_user_detail_to_response(request, response):
         g.audit_object.add_policy([p.get("name") for p in detail_pol])
 
     # Check for ADD RESOLVER IN RESPONSE
-    detail_pol = Match.action_only(g, scope=SCOPE.AUTHZ, action=ACTION.ADDRESOLVERINRESPONSE)\
+    detail_pol = Match.user(g, scope=SCOPE.AUTHZ, action=ACTION.ADDRESOLVERINRESPONSE, user_object=request.User)\
         .policies(write_to_audit_log=False)
     if detail_pol and content.get("result", {}).get("value") and request.User:
         # The policy was set, we need to add the resolver and the realm


Test patch:
diff --git a/tests/test_api_lib_policy.py b/tests/test_api_lib_policy.py
--- a/tests/test_api_lib_policy.py
+++ b/tests/test_api_lib_policy.py
@@ -3335,6 +3335,24 @@ def test_04_add_user_in_response(self):
         self.assertFalse("user-resolver" in jresult.get("detail"), jresult)
         self.assertFalse("user-realm" in jresult.get("detail"), jresult)
 
+        # check with different realm in policy conditions
+        # if the user-name is evaluated
+        # in add_user_in_response policy
+        res = {"result": {"status": True,
+                          "value": True},
+               "detail": {"message": "matching 1 tokens",
+                          "serial": "HOTP123456",
+                          "type": "hotp"}}
+        resp = jsonify(res)
+        set_policy(name="pol_add_user",
+                   scope=SCOPE.AUTHZ,
+                   action=ACTION.ADDUSERINRESPONSE, client="10.0.0.0/8", realm=self.realm2)
+        g.policy_object = PolicyClass()
+
+        new_response = add_user_detail_to_response(req, resp)
+        jresult = new_response.json
+        self.assertNotIn("user", jresult.get("detail"), jresult)
+
         # set a policy that adds user resolver to detail
         set_policy(name="pol_add_resolver",
                    scope=SCOPE.AUTHZ,
@@ -3351,6 +3369,28 @@ def test_04_add_user_in_response(self):
         delete_policy("pol_add_user")
         delete_policy("pol_add_resolver")
 
+        # check with different realm in policy conditions
+        # if the user-realm is evaluated
+        # in add_resolver_in_response policy
+        res = {
+            "result": {
+                "status": True,
+                "value": True},
+            "detail": {
+                "message": "matching 1 tokens",
+                "serial": "HOTP123456",
+                "type": "hotp"}}
+        resp = jsonify(res)
+        set_policy(name="pol_add_resolver",
+                   scope=SCOPE.AUTHZ,
+                   action=ACTION.ADDRESOLVERINRESPONSE, client="10.0.0.0/8", realm=self.realm2)
+        g.policy_object = PolicyClass()
+
+        new_response = add_user_detail_to_response(req, resp)
+        jresult = new_response.json
+        self.assertNotIn("user-realm", jresult.get("detail"), jresult)
+        self.assertNotIn("user-resolver", jresult.get("detail"), jresult)
+
     def test_05_autoassign_any_pin(self):
         # init a token, that does has no uwser
         self.setUp_user_realms()