Custom member role without permissions

Question

Hello everyone,

It is possible to create a custom member role in Portal and assign the role with no permissions. When assigning this role to a user, and logging into the Portal with this user, one can observe the restricted access the user has.

However, when logging into the .../portal/sharing/rest, the same user seems to have more rights. One example is that the user is able to delete itself with "delete user" resource - this is generally not a big security issue, but makes me worried that maybe the user have more rights than intended with the custom role.

Does anyone have insight into why the resources in .../portal/sharing/rest is seemingly available to the user although the user has no permissions?

KamillaHum · Answer

Hello @RyanUthoff,

Thanks for your answer,

Yes I agree, disabling the directory is an option to quickly fix this issue. However, it is still curious that the permissions in Portal Home is not reflected in the Portal Directory. As you say, it seems like a clear violation of the security roles, and it creates a false safety I think.

It would be great if anyone from ESRI could explain why this violation is happening. I will likely create a support case if this post does not reach them.

ryanuthoff · Answer

I can replicate this issue. It's kind of weird that Esri would allow a user to delete their own account through the rest endpoint (this is the case even when not using a custom role and just using a viewer user type and role). Luckily, it appears the changes the user can make are isolated to their own account and not anyone else. Also, it appears that the user isn't allowed to do other things, like create groups, etc. which is good.

With that being said, in my opinion, Esri allowing a viewer only user type (or an account with a role without administrative privileges) to delete their own account is an explicit violation of Esri's own security roles. If the role privilege below is disabled, Esri should not allow that user to be able to delete any accounts, not even their own.

On a side note, if you don't want people having access to the portal rest endpoint at all, you can always disable it. https://enterprise.arcgis.com/en/portal/11.5/administer/windows/disabling-the-arcgis-portal-directory.htm