dtolabs/rundeck — pull request #472 by sfdc-kho (2013-07-27 00:28:09+00:00)
Title: Unprivileged users can access execution api actions

We have a deployment user with aclpolicy:
```
description: API Application level access control
context:
application: 'rundeck'
for:
resource:
- equals:
kind: system
allow: [read] # allow read of system info
by:
group: deploy_user
```

When we login to the rundeck UI with this user, we immediately are hit with this message:
```
No authorized access to projects. Contact your administrator. (User roles: deploy_user, user)
```

But when I try `http://localhost:4440/api/1/execution/32`, I can see the execution output.

After change:
```
HTTP/1.1 403 Forbidden
Not authorized for action "read" for Execution 32
```