mirror of
https://github.com/google/nomulus
synced 2026-09-06 16:17:13 +00:00
Remove internal auth mechanism (#2066)
It was used by cron job and task queues, which now use OIDC-based auth. Also renamed and consolidated auth enums to make them easier to understand. Ultimately we should get rid of the AuthMethod part as OIDC will be the only auth method used. Based on the updated routing map: Backend and tools: the only change is that INTERNAL is removed from allowed auth methods. Should be an no-op. Pubapi: INTERNAL is removed from allowed auth. For endpoints that only allowed INTERNAL before, API and LEGACY become the allowed methods. However this should not affect anything because regardless of which auth method is ultimately used, the required auth level is always NONE for pubapi endpoints. Therefore any auth result is discarded anyway. Frontend: INTERNAL is removed. RegistryLockVerifyAction has lowered its required auth level to NONE because it extends HtmlAction, which can redirect the user to login if necessary. All other endpoints extending HtmlAction require NONE, so it's better to keep things consistent.
This commit is contained in:
Lai Jiang
@@ -47,7 +47,7 @@ class RdapActionBaseTest extends RdapActionBaseTestCase<RdapActionBaseTest.RdapT
|
||||
service = Action.Service.PUBAPI,
|
||||
path = "/rdap/test/",
|
||||
method = {GET, HEAD},
|
||||
auth = Auth.AUTH_PUBLIC_ANONYMOUS)
|
||||
auth = Auth.AUTH_PUBLIC)
|
||||
public static class RdapTestAction extends RdapActionBase {
|
||||
|
||||
public RdapTestAction() {
|
||||
|
||||
@@ -18,8 +18,7 @@ import static com.google.common.truth.Truth.assertThat;
|
||||
import static com.google.common.truth.Truth8.assertThat;
|
||||
import static google.registry.request.Action.Method.GET;
|
||||
import static google.registry.request.Action.Method.POST;
|
||||
import static google.registry.request.auth.Auth.AUTH_INTERNAL_ONLY;
|
||||
import static google.registry.request.auth.Auth.AUTH_INTERNAL_OR_ADMIN;
|
||||
import static google.registry.request.auth.Auth.AUTH_API_ADMIN;
|
||||
import static google.registry.request.auth.Auth.AUTH_PUBLIC;
|
||||
import static org.mockito.ArgumentMatchers.any;
|
||||
import static org.mockito.ArgumentMatchers.eq;
|
||||
@@ -123,7 +122,7 @@ public final class RequestHandlerTest {
|
||||
@Action(
|
||||
service = Action.Service.DEFAULT,
|
||||
path = "/auth/adminUser",
|
||||
auth = AUTH_INTERNAL_OR_ADMIN,
|
||||
auth = AUTH_API_ADMIN,
|
||||
method = GET)
|
||||
public class AuthAdminUserAction extends AuthBase {
|
||||
AuthAdminUserAction(AuthResult authResult) {
|
||||
@@ -131,17 +130,6 @@ public final class RequestHandlerTest {
|
||||
}
|
||||
}
|
||||
|
||||
@Action(
|
||||
service = Action.Service.DEFAULT,
|
||||
path = "/auth/internal",
|
||||
auth = AUTH_INTERNAL_ONLY,
|
||||
method = GET)
|
||||
public class AuthInternalAction extends AuthBase {
|
||||
AuthInternalAction(AuthResult authResult) {
|
||||
super(authResult);
|
||||
}
|
||||
}
|
||||
|
||||
public class Component {
|
||||
|
||||
private RequestModule requestModule = null;
|
||||
@@ -181,10 +169,6 @@ public final class RequestHandlerTest {
|
||||
public AuthAdminUserAction authAdminUserAction() {
|
||||
return new AuthAdminUserAction(component.getRequestModule().provideAuthResult());
|
||||
}
|
||||
|
||||
public AuthInternalAction authInternalAction() {
|
||||
return new AuthInternalAction(component.getRequestModule().provideAuthResult());
|
||||
}
|
||||
}
|
||||
|
||||
/** Fake Builder for the fake component above to satisfy RequestHandler expectations. */
|
||||
@@ -442,7 +426,7 @@ public final class RequestHandlerTest {
|
||||
void testAuthNeeded_failure() throws Exception {
|
||||
when(req.getMethod()).thenReturn("GET");
|
||||
when(req.getRequestURI()).thenReturn("/auth/adminUser");
|
||||
when(requestAuthenticator.authorize(AUTH_INTERNAL_OR_ADMIN.authSettings(), req))
|
||||
when(requestAuthenticator.authorize(AUTH_API_ADMIN.authSettings(), req))
|
||||
.thenReturn(Optional.empty());
|
||||
|
||||
handler.handleRequest(req, rsp);
|
||||
@@ -455,7 +439,7 @@ public final class RequestHandlerTest {
|
||||
void testAuthNeeded_success() throws Exception {
|
||||
when(req.getMethod()).thenReturn("GET");
|
||||
when(req.getRequestURI()).thenReturn("/auth/adminUser");
|
||||
when(requestAuthenticator.authorize(AUTH_INTERNAL_OR_ADMIN.authSettings(), req))
|
||||
when(requestAuthenticator.authorize(AUTH_API_ADMIN.authSettings(), req))
|
||||
.thenReturn(
|
||||
Optional.of(AuthResult.create(AuthLevel.USER, UserAuthInfo.create(testUser, true))));
|
||||
|
||||
@@ -468,32 +452,4 @@ public final class RequestHandlerTest {
|
||||
assertThat(providedAuthResult.userAuthInfo().get().oauthTokenInfo()).isEmpty();
|
||||
assertMetric("/auth/adminUser", GET, AuthLevel.USER, true);
|
||||
}
|
||||
|
||||
@Test
|
||||
void testInternalAuthNeeded_failure() throws Exception {
|
||||
when(req.getMethod()).thenReturn("GET");
|
||||
when(req.getRequestURI()).thenReturn("/auth/internal");
|
||||
when(requestAuthenticator.authorize(AUTH_INTERNAL_ONLY.authSettings(), req))
|
||||
.thenReturn(Optional.empty());
|
||||
|
||||
handler.handleRequest(req, rsp);
|
||||
|
||||
verify(rsp).sendError(403, "Not authorized");
|
||||
assertThat(providedAuthResult).isNull();
|
||||
}
|
||||
|
||||
@Test
|
||||
void testInternalAuthNeeded_success() throws Exception {
|
||||
when(req.getMethod()).thenReturn("GET");
|
||||
when(req.getRequestURI()).thenReturn("/auth/internal");
|
||||
when(requestAuthenticator.authorize(AUTH_INTERNAL_ONLY.authSettings(), req))
|
||||
.thenReturn(Optional.of(AuthResult.create(AuthLevel.APP)));
|
||||
|
||||
handler.handleRequest(req, rsp);
|
||||
|
||||
assertThat(providedAuthResult).isNotNull();
|
||||
assertThat(providedAuthResult.authLevel()).isEqualTo(AuthLevel.APP);
|
||||
assertThat(providedAuthResult.userAuthInfo()).isEmpty();
|
||||
assertMetric("/auth/internal", GET, AuthLevel.APP, true);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -16,7 +16,7 @@ package google.registry.request;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static com.google.common.truth.Truth8.assertThat;
|
||||
import static google.registry.request.auth.Auth.AUTH_INTERNAL_OR_ADMIN;
|
||||
import static google.registry.request.auth.Auth.AUTH_API_ADMIN;
|
||||
import static org.junit.jupiter.api.Assertions.assertThrows;
|
||||
|
||||
import java.util.Optional;
|
||||
@@ -42,7 +42,7 @@ public final class RouterTest {
|
||||
|
||||
////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
@Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_INTERNAL_OR_ADMIN)
|
||||
@Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_API_ADMIN)
|
||||
public static final class SlothTask implements Runnable {
|
||||
@Override
|
||||
public void run() {}
|
||||
@@ -76,7 +76,7 @@ public final class RouterTest {
|
||||
service = Action.Service.DEFAULT,
|
||||
path = "/prefix",
|
||||
isPrefix = true,
|
||||
auth = AUTH_INTERNAL_OR_ADMIN)
|
||||
auth = AUTH_API_ADMIN)
|
||||
public static final class PrefixTask implements Runnable {
|
||||
@Override
|
||||
public void run() {}
|
||||
@@ -106,7 +106,7 @@ public final class RouterTest {
|
||||
service = Action.Service.DEFAULT,
|
||||
path = "/prefix/long",
|
||||
isPrefix = true,
|
||||
auth = AUTH_INTERNAL_OR_ADMIN)
|
||||
auth = AUTH_API_ADMIN)
|
||||
public static final class LongTask implements Runnable {
|
||||
@Override
|
||||
public void run() {}
|
||||
@@ -158,19 +158,13 @@ public final class RouterTest {
|
||||
|
||||
////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
@Action(
|
||||
service = Action.Service.DEFAULT,
|
||||
path = "/samePathAsOtherTask",
|
||||
auth = AUTH_INTERNAL_OR_ADMIN)
|
||||
@Action(service = Action.Service.DEFAULT, path = "/samePathAsOtherTask", auth = AUTH_API_ADMIN)
|
||||
public static final class DuplicateTask1 implements Runnable {
|
||||
@Override
|
||||
public void run() {}
|
||||
}
|
||||
|
||||
@Action(
|
||||
service = Action.Service.DEFAULT,
|
||||
path = "/samePathAsOtherTask",
|
||||
auth = AUTH_INTERNAL_OR_ADMIN)
|
||||
@Action(service = Action.Service.DEFAULT, path = "/samePathAsOtherTask", auth = AUTH_API_ADMIN)
|
||||
public static final class DuplicateTask2 implements Runnable {
|
||||
@Override
|
||||
public void run() {}
|
||||
|
||||
@@ -49,11 +49,7 @@ class RequestAuthenticatorTest {
|
||||
new JpaTestExtensions.Builder().buildIntegrationTestExtension();
|
||||
|
||||
private static final AuthSettings AUTH_NONE =
|
||||
AuthSettings.create(
|
||||
ImmutableList.of(AuthMethod.INTERNAL), AuthLevel.NONE, UserPolicy.IGNORED);
|
||||
|
||||
private static final AuthSettings AUTH_INTERNAL_OR_ADMIN =
|
||||
AuthSettings.create(ImmutableList.of(AuthMethod.INTERNAL), AuthLevel.APP, UserPolicy.IGNORED);
|
||||
AuthSettings.create(ImmutableList.of(AuthMethod.API), AuthLevel.NONE, UserPolicy.PUBLIC);
|
||||
|
||||
private static final AuthSettings AUTH_ANY_USER_ANY_METHOD =
|
||||
AuthSettings.create(
|
||||
@@ -67,27 +63,18 @@ class RequestAuthenticatorTest {
|
||||
ImmutableList.of(AuthMethod.API, AuthMethod.LEGACY), AuthLevel.USER, UserPolicy.ADMIN);
|
||||
|
||||
private static final AuthSettings AUTH_NO_METHODS =
|
||||
AuthSettings.create(ImmutableList.of(), AuthLevel.APP, UserPolicy.IGNORED);
|
||||
AuthSettings.create(ImmutableList.of(), AuthLevel.APP, UserPolicy.PUBLIC);
|
||||
|
||||
private static final AuthSettings AUTH_WRONG_METHOD_ORDERING =
|
||||
AuthSettings.create(
|
||||
ImmutableList.of(AuthMethod.API, AuthMethod.INTERNAL), AuthLevel.APP, UserPolicy.IGNORED);
|
||||
ImmutableList.of(AuthMethod.LEGACY, AuthMethod.API), AuthLevel.APP, UserPolicy.PUBLIC);
|
||||
|
||||
private static final AuthSettings AUTH_DUPLICATE_METHODS =
|
||||
AuthSettings.create(
|
||||
ImmutableList.of(AuthMethod.INTERNAL, AuthMethod.API, AuthMethod.API),
|
||||
AuthLevel.APP,
|
||||
UserPolicy.IGNORED);
|
||||
ImmutableList.of(AuthMethod.API, AuthMethod.API), AuthLevel.APP, UserPolicy.PUBLIC);
|
||||
|
||||
private static final AuthSettings AUTH_INTERNAL_WITH_USER =
|
||||
AuthSettings.create(
|
||||
ImmutableList.of(AuthMethod.INTERNAL, AuthMethod.API),
|
||||
AuthLevel.USER,
|
||||
UserPolicy.IGNORED);
|
||||
|
||||
private static final AuthSettings AUTH_WRONGLY_IGNORING_USER =
|
||||
AuthSettings.create(
|
||||
ImmutableList.of(AuthMethod.INTERNAL, AuthMethod.API), AuthLevel.APP, UserPolicy.IGNORED);
|
||||
private static final AuthSettings AUTH_NONE_REQUIRES_ADMIN =
|
||||
AuthSettings.create(ImmutableList.of(AuthMethod.API), AuthLevel.NONE, UserPolicy.ADMIN);
|
||||
|
||||
private final UserService mockUserService = mock(UserService.class);
|
||||
private final HttpServletRequest req = mock(HttpServletRequest.class);
|
||||
@@ -96,12 +83,13 @@ class RequestAuthenticatorTest {
|
||||
private final FakeUserService fakeUserService = new FakeUserService();
|
||||
private final XsrfTokenManager xsrfTokenManager =
|
||||
new XsrfTokenManager(new FakeClock(), fakeUserService);
|
||||
private final FakeOAuthService fakeOAuthService = new FakeOAuthService(
|
||||
false /* isOAuthEnabled */,
|
||||
testUser,
|
||||
false /* isUserAdmin */,
|
||||
"test-client-id",
|
||||
ImmutableList.of("test-scope1", "test-scope2", "nontest-scope"));
|
||||
private final FakeOAuthService fakeOAuthService =
|
||||
new FakeOAuthService(
|
||||
false /* isOAuthEnabled */,
|
||||
testUser,
|
||||
false /* isUserAdmin */,
|
||||
"test-client-id",
|
||||
ImmutableList.of("test-scope1", "test-scope2", "nontest-scope"));
|
||||
|
||||
@BeforeEach
|
||||
void beforeEach() {
|
||||
@@ -110,7 +98,6 @@ class RequestAuthenticatorTest {
|
||||
|
||||
private RequestAuthenticator createRequestAuthenticator(UserService userService) {
|
||||
return new RequestAuthenticator(
|
||||
new AppEngineInternalAuthenticationMechanism(fakeUserService),
|
||||
ImmutableList.of(
|
||||
new OAuthAuthenticationMechanism(
|
||||
fakeOAuthService,
|
||||
@@ -121,8 +108,7 @@ class RequestAuthenticatorTest {
|
||||
}
|
||||
|
||||
private Optional<AuthResult> runTest(UserService userService, AuthSettings auth) {
|
||||
return createRequestAuthenticator(userService)
|
||||
.authorize(auth, req);
|
||||
return createRequestAuthenticator(userService).authorize(auth, req);
|
||||
}
|
||||
|
||||
@Test
|
||||
@@ -134,48 +120,6 @@ class RequestAuthenticatorTest {
|
||||
assertThat(authResult.get().authLevel()).isEqualTo(AuthLevel.NONE);
|
||||
}
|
||||
|
||||
@Test
|
||||
void testNoAuthNeeded_internalFound() {
|
||||
when(req.getHeader("X-AppEngine-QueueName")).thenReturn("__cron");
|
||||
|
||||
Optional<AuthResult> authResult = runTest(mockUserService, AUTH_NONE);
|
||||
|
||||
verifyNoInteractions(mockUserService);
|
||||
assertThat(authResult).isPresent();
|
||||
assertThat(authResult.get().authLevel()).isEqualTo(AuthLevel.APP);
|
||||
assertThat(authResult.get().userAuthInfo()).isEmpty();
|
||||
}
|
||||
|
||||
@Test
|
||||
void testInternalAuth_notInvokedInternally() {
|
||||
Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
|
||||
|
||||
verifyNoInteractions(mockUserService);
|
||||
assertThat(authResult).isEmpty();
|
||||
}
|
||||
|
||||
@Test
|
||||
void testInternalAuth_success() {
|
||||
when(req.getHeader("X-AppEngine-QueueName")).thenReturn("__cron");
|
||||
|
||||
Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
|
||||
|
||||
verifyNoInteractions(mockUserService);
|
||||
assertThat(authResult).isPresent();
|
||||
assertThat(authResult.get().authLevel()).isEqualTo(AuthLevel.APP);
|
||||
assertThat(authResult.get().userAuthInfo()).isEmpty();
|
||||
}
|
||||
|
||||
@Test
|
||||
void testInternalAuth_failForAdminUser() {
|
||||
when(req.getHeader("X-AppEngine-QueueName")).thenReturn("__cron");
|
||||
fakeUserService.setUser(testUser, true /* isAdmin */);
|
||||
|
||||
Optional<AuthResult> authResult = runTest(fakeUserService, AUTH_INTERNAL_OR_ADMIN);
|
||||
|
||||
assertThat(authResult).isEmpty();
|
||||
}
|
||||
|
||||
@Test
|
||||
void testAnyUserAnyMethod_notLoggedIn() {
|
||||
Optional<AuthResult> authResult = runTest(fakeUserService, AUTH_ANY_USER_ANY_METHOD);
|
||||
@@ -280,9 +224,9 @@ class RequestAuthenticatorTest {
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().authorizedScopes())
|
||||
.containsAtLeast("test-scope1", "test-scope2");
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().oauthClientId())
|
||||
.isEqualTo("test-client-id");
|
||||
.isEqualTo("test-client-id");
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().rawAccessToken())
|
||||
.isEqualTo("TOKEN");
|
||||
.isEqualTo("TOKEN");
|
||||
}
|
||||
|
||||
@Test
|
||||
@@ -303,9 +247,9 @@ class RequestAuthenticatorTest {
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().authorizedScopes())
|
||||
.containsAtLeast("test-scope1", "test-scope2");
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().oauthClientId())
|
||||
.isEqualTo("test-client-id");
|
||||
.isEqualTo("test-client-id");
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().rawAccessToken())
|
||||
.isEqualTo("TOKEN");
|
||||
.isEqualTo("TOKEN");
|
||||
}
|
||||
|
||||
@Test
|
||||
@@ -372,9 +316,9 @@ class RequestAuthenticatorTest {
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().authorizedScopes())
|
||||
.containsAtLeast("test-scope1", "test-scope2", "test-scope3");
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().oauthClientId())
|
||||
.isEqualTo("test-client-id");
|
||||
.isEqualTo("test-client-id");
|
||||
assertThat(authResult.get().userAuthInfo().get().oauthTokenInfo().get().rawAccessToken())
|
||||
.isEqualTo("TOKEN");
|
||||
.isEqualTo("TOKEN");
|
||||
}
|
||||
|
||||
@Test
|
||||
@@ -387,7 +331,7 @@ class RequestAuthenticatorTest {
|
||||
}
|
||||
|
||||
@Test
|
||||
void testCheckAuthConfig_NoMethods_failure() {
|
||||
void testCheckAuthConfig_noMethods_failure() {
|
||||
IllegalArgumentException thrown =
|
||||
assertThrows(
|
||||
IllegalArgumentException.class,
|
||||
@@ -396,14 +340,25 @@ class RequestAuthenticatorTest {
|
||||
}
|
||||
|
||||
@Test
|
||||
void testCheckAuthConfig_WrongMethodOrdering_failure() {
|
||||
void testCheckAuthConfig_wrongMethodOrdering_failure() {
|
||||
IllegalArgumentException thrown =
|
||||
assertThrows(
|
||||
IllegalArgumentException.class,
|
||||
() -> RequestAuthenticator.checkAuthConfig(AUTH_WRONG_METHOD_ORDERING));
|
||||
assertThat(thrown)
|
||||
.hasMessageThat()
|
||||
.contains("Auth methods must be unique and strictly in order - INTERNAL, API, LEGACY");
|
||||
.contains("Auth methods must be unique and strictly in order - API, LEGACY");
|
||||
}
|
||||
|
||||
@Test
|
||||
void testCheckAuthConfig_noneAuthLevelRequiresAdmin_failure() {
|
||||
IllegalArgumentException thrown =
|
||||
assertThrows(
|
||||
IllegalArgumentException.class,
|
||||
() -> RequestAuthenticator.checkAuthConfig(AUTH_NONE_REQUIRES_ADMIN));
|
||||
assertThat(thrown)
|
||||
.hasMessageThat()
|
||||
.contains("Actions with minimal auth level at NONE should not specify ADMIN user policy");
|
||||
}
|
||||
|
||||
@Test
|
||||
@@ -414,29 +369,6 @@ class RequestAuthenticatorTest {
|
||||
() -> RequestAuthenticator.checkAuthConfig(AUTH_DUPLICATE_METHODS));
|
||||
assertThat(thrown)
|
||||
.hasMessageThat()
|
||||
.contains("Auth methods must be unique and strictly in order - INTERNAL, API, LEGACY");
|
||||
}
|
||||
|
||||
@Test
|
||||
void testCheckAuthConfig_InternalWithUser_failure() {
|
||||
IllegalArgumentException thrown =
|
||||
assertThrows(
|
||||
IllegalArgumentException.class,
|
||||
() -> RequestAuthenticator.checkAuthConfig(AUTH_INTERNAL_WITH_USER));
|
||||
assertThat(thrown)
|
||||
.hasMessageThat()
|
||||
.contains("Actions with INTERNAL auth method may not require USER auth level");
|
||||
}
|
||||
|
||||
@Test
|
||||
void testCheckAuthConfig_WronglyIgnoringUser_failure() {
|
||||
IllegalArgumentException thrown =
|
||||
assertThrows(
|
||||
IllegalArgumentException.class,
|
||||
() -> RequestAuthenticator.checkAuthConfig(AUTH_WRONGLY_IGNORING_USER));
|
||||
assertThat(thrown)
|
||||
.hasMessageThat()
|
||||
.contains(
|
||||
"Actions with auth methods beyond INTERNAL must not specify the IGNORED user policy");
|
||||
.contains("Auth methods must be unique and strictly in order - API, LEGACY");
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,39 +1,39 @@
|
||||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/cron/fanout TldFanoutAction GET y INTERNAL,API APP ADMIN
|
||||
/_dr/dnsRefresh RefreshDnsAction GET y INTERNAL,API APP ADMIN
|
||||
/_dr/task/brdaCopy BrdaCopyAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/copyDetailReports CopyDetailReportsAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/deleteExpiredDomains DeleteExpiredDomainsAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/deleteProberData DeleteProberDataAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/executeCannedScript CannedScriptExecutionAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/expandBillingRecurrences ExpandBillingRecurrencesAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/exportDomainLists ExportDomainListsAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/generateInvoices GenerateInvoicesAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/generateSpec11 GenerateSpec11ReportAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/icannReportingStaging IcannReportingStagingAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/icannReportingUpload IcannReportingUploadAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/nordnUpload NordnUploadAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/nordnVerify NordnVerifyAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/publishInvoices PublishInvoicesAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/publishSpec11 PublishSpec11ReportAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/rdeReport RdeReportAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/rdeStaging RdeStagingAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/rdeUpload RdeUploadAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/readDnsRefreshRequests ReadDnsRefreshRequestsAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/relockDomain RelockDomainAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/resaveAllEppResourcesPipeline ResaveAllEppResourcesPipelineAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/resaveEntity ResaveEntityAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/sendExpiringCertificateNotificationEmail SendExpiringCertificateNotificationEmailAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/tmchCrl TmchCrlAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/tmchDnl TmchDnlAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/tmchSmdrl TmchSmdrlAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/updateRegistrarRdapBaseUrls UpdateRegistrarRdapBaseUrlsAction GET y INTERNAL,API APP ADMIN
|
||||
/_dr/task/wipeOutCloudSql WipeOutCloudSqlAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/wipeOutContactHistoryPii WipeOutContactHistoryPiiAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/cron/fanout TldFanoutAction GET y API APP ADMIN
|
||||
/_dr/dnsRefresh RefreshDnsAction GET y API APP ADMIN
|
||||
/_dr/task/brdaCopy BrdaCopyAction POST y API APP ADMIN
|
||||
/_dr/task/copyDetailReports CopyDetailReportsAction POST n API APP ADMIN
|
||||
/_dr/task/deleteExpiredDomains DeleteExpiredDomainsAction GET n API APP ADMIN
|
||||
/_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n API APP ADMIN
|
||||
/_dr/task/deleteProberData DeleteProberDataAction POST n API APP ADMIN
|
||||
/_dr/task/executeCannedScript CannedScriptExecutionAction POST y API APP ADMIN
|
||||
/_dr/task/expandBillingRecurrences ExpandBillingRecurrencesAction GET n API APP ADMIN
|
||||
/_dr/task/exportDomainLists ExportDomainListsAction POST n API APP ADMIN
|
||||
/_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n API APP ADMIN
|
||||
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n API APP ADMIN
|
||||
/_dr/task/generateInvoices GenerateInvoicesAction POST n API APP ADMIN
|
||||
/_dr/task/generateSpec11 GenerateSpec11ReportAction POST n API APP ADMIN
|
||||
/_dr/task/icannReportingStaging IcannReportingStagingAction POST n API APP ADMIN
|
||||
/_dr/task/icannReportingUpload IcannReportingUploadAction POST n API APP ADMIN
|
||||
/_dr/task/nordnUpload NordnUploadAction POST y API APP ADMIN
|
||||
/_dr/task/nordnVerify NordnVerifyAction POST y API APP ADMIN
|
||||
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y API APP ADMIN
|
||||
/_dr/task/publishInvoices PublishInvoicesAction POST n API APP ADMIN
|
||||
/_dr/task/publishSpec11 PublishSpec11ReportAction POST n API APP ADMIN
|
||||
/_dr/task/rdeReport RdeReportAction POST n API APP ADMIN
|
||||
/_dr/task/rdeStaging RdeStagingAction GET,POST n API APP ADMIN
|
||||
/_dr/task/rdeUpload RdeUploadAction POST n API APP ADMIN
|
||||
/_dr/task/readDnsRefreshRequests ReadDnsRefreshRequestsAction POST y API APP ADMIN
|
||||
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction POST n API APP ADMIN
|
||||
/_dr/task/relockDomain RelockDomainAction POST y API APP ADMIN
|
||||
/_dr/task/resaveAllEppResourcesPipeline ResaveAllEppResourcesPipelineAction GET n API APP ADMIN
|
||||
/_dr/task/resaveEntity ResaveEntityAction POST n API APP ADMIN
|
||||
/_dr/task/sendExpiringCertificateNotificationEmail SendExpiringCertificateNotificationEmailAction GET n API APP ADMIN
|
||||
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n API APP ADMIN
|
||||
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n API APP ADMIN
|
||||
/_dr/task/tmchCrl TmchCrlAction POST y API APP ADMIN
|
||||
/_dr/task/tmchDnl TmchDnlAction POST y API APP ADMIN
|
||||
/_dr/task/tmchSmdrl TmchSmdrlAction POST y API APP ADMIN
|
||||
/_dr/task/updateRegistrarRdapBaseUrls UpdateRegistrarRdapBaseUrlsAction GET y API APP ADMIN
|
||||
/_dr/task/wipeOutCloudSql WipeOutCloudSqlAction GET n API APP ADMIN
|
||||
/_dr/task/wipeOutContactHistoryPii WipeOutContactHistoryPiiAction GET n API APP ADMIN
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/epp EppTlsAction POST n INTERNAL,API APP PUBLIC
|
||||
/console-api/domain ConsoleDomainGetAction GET n API,LEGACY USER PUBLIC
|
||||
/console-api/registrars RegistrarsAction GET n API,LEGACY USER PUBLIC
|
||||
/console-api/settings/contacts ContactAction GET,POST n API,LEGACY USER PUBLIC
|
||||
/registrar ConsoleUiAction GET n INTERNAL,API,LEGACY NONE PUBLIC
|
||||
/registrar-create ConsoleRegistrarCreatorAction POST,GET n INTERNAL,API,LEGACY NONE PUBLIC
|
||||
/registrar-ote-setup ConsoleOteSetupAction POST,GET n INTERNAL,API,LEGACY NONE PUBLIC
|
||||
/registrar-ote-status OteStatusAction POST n API,LEGACY USER PUBLIC
|
||||
/registrar-settings RegistrarSettingsAction POST n API,LEGACY USER PUBLIC
|
||||
/registry-lock-get RegistryLockGetAction GET n API,LEGACY USER PUBLIC
|
||||
/registry-lock-post RegistryLockPostAction POST n API,LEGACY USER PUBLIC
|
||||
/registry-lock-verify RegistryLockVerifyAction GET n API,LEGACY USER PUBLIC
|
||||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/epp EppTlsAction POST n API APP PUBLIC
|
||||
/console-api/domain ConsoleDomainGetAction GET n API,LEGACY USER PUBLIC
|
||||
/console-api/registrars RegistrarsAction GET n API,LEGACY USER PUBLIC
|
||||
/console-api/settings/contacts ContactAction GET,POST n API,LEGACY USER PUBLIC
|
||||
/registrar ConsoleUiAction GET n API,LEGACY NONE PUBLIC
|
||||
/registrar-create ConsoleRegistrarCreatorAction POST,GET n API,LEGACY NONE PUBLIC
|
||||
/registrar-ote-setup ConsoleOteSetupAction POST,GET n API,LEGACY NONE PUBLIC
|
||||
/registrar-ote-status OteStatusAction POST n API,LEGACY USER PUBLIC
|
||||
/registrar-settings RegistrarSettingsAction POST n API,LEGACY USER PUBLIC
|
||||
/registry-lock-get RegistryLockGetAction GET n API,LEGACY USER PUBLIC
|
||||
/registry-lock-post RegistryLockPostAction POST n API,LEGACY USER PUBLIC
|
||||
/registry-lock-verify RegistryLockVerifyAction GET n API,LEGACY NONE PUBLIC
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/whois WhoisAction POST n INTERNAL,API APP PUBLIC
|
||||
/check CheckApiAction GET n INTERNAL NONE PUBLIC
|
||||
/rdap/autnum/(*) RdapAutnumAction GET,HEAD n INTERNAL NONE PUBLIC
|
||||
/rdap/domain/(*) RdapDomainAction GET,HEAD n INTERNAL,API,LEGACY NONE PUBLIC
|
||||
/rdap/domains RdapDomainSearchAction GET,HEAD n INTERNAL,API,LEGACY NONE PUBLIC
|
||||
/rdap/entities RdapEntitySearchAction GET,HEAD n INTERNAL,API,LEGACY NONE PUBLIC
|
||||
/rdap/entity/(*) RdapEntityAction GET,HEAD n INTERNAL,API,LEGACY NONE PUBLIC
|
||||
/rdap/help(*) RdapHelpAction GET,HEAD n INTERNAL NONE PUBLIC
|
||||
/rdap/ip/(*) RdapIpAction GET,HEAD n INTERNAL NONE PUBLIC
|
||||
/rdap/nameserver/(*) RdapNameserverAction GET,HEAD n INTERNAL NONE PUBLIC
|
||||
/rdap/nameservers RdapNameserverSearchAction GET,HEAD n INTERNAL NONE PUBLIC
|
||||
/whois/(*) WhoisHttpAction GET n INTERNAL NONE PUBLIC
|
||||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/whois WhoisAction POST n API APP PUBLIC
|
||||
/check CheckApiAction GET n API,LEGACY NONE PUBLIC
|
||||
/rdap/autnum/(*) RdapAutnumAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/domain/(*) RdapDomainAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/domains RdapDomainSearchAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/entities RdapEntitySearchAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/entity/(*) RdapEntityAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/help(*) RdapHelpAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/ip/(*) RdapIpAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/nameserver/(*) RdapNameserverAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/rdap/nameservers RdapNameserverSearchAction GET,HEAD n API,LEGACY NONE PUBLIC
|
||||
/whois/(*) WhoisHttpAction GET n API,LEGACY NONE PUBLIC
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/admin/createGroups CreateGroupsAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/domains ListDomainsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/hosts ListHostsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/tlds ListTldsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/verifyOte VerifyOteAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/epptool EppToolAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/loadtest LoadTestAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/createGroups CreateGroupsAction POST n API APP ADMIN
|
||||
/_dr/admin/list/domains ListDomainsAction GET,POST n API APP ADMIN
|
||||
/_dr/admin/list/hosts ListHostsAction GET,POST n API APP ADMIN
|
||||
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n API APP ADMIN
|
||||
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n API APP ADMIN
|
||||
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n API APP ADMIN
|
||||
/_dr/admin/list/tlds ListTldsAction GET,POST n API APP ADMIN
|
||||
/_dr/admin/verifyOte VerifyOteAction POST n API APP ADMIN
|
||||
/_dr/epptool EppToolAction POST n API APP ADMIN
|
||||
/_dr/loadtest LoadTestAction POST y API APP ADMIN
|
||||
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n API APP ADMIN
|
||||
/_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n API APP ADMIN
|
||||
|
||||
Reference in New Issue
Block a user