fix: encode OpenShift group names in advanced authorization by nikitapal-12 · Pull Request #1071 · eclipse-che/che-server

nikitapal-12 · 2026-09-21T11:24:41Z

Group names with spaces (common for Active Directory) produced an unencoded Groups API path and failed with URISyntaxException when users opened the dashboard.

Fixes https://issues.redhat.com/browse/CRW-13184

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

Deploy Che with this PR’s che-server image.
Enable advanced authorization and use an OpenShift group whose name contains a space (for example an AD-style group).
Log in as a user in that group and open the Che dashboard.
Confirm the dashboard loads and there is no URISyntaxException from the Groups API path.

PR Checklist

As the author of this Pull Request I made sure that:

Release Notes

Reviewers

Reviewers, please comment how you tested the PR when approving it.

Summary by CodeRabbit

Bug Fixes
- OpenShift authorization now correctly handles group names containing spaces or other reserved characters. Users who belong to an allowed group with these characters can be authorized as expected, while users who are not members remain unauthorized.

Group names with spaces (common for Active Directory) produced an unencoded Groups API path and failed with URISyntaxException when users opened the dashboard. Fixes https://issues.redhat.com/browse/CRW-13184 Signed-off-by: Nikita Pal <npal@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

openshift-ci · 2026-09-21T11:24:52Z

Hi @nikitapal-12. Thanks for your PR.

I'm waiting for a eclipse-che member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

tolusha · 2026-09-21T12:11:20Z

@nikitapal-12
Pls feel in PR descriptions and sign ECA

nikitapal-12 · 2026-09-21T13:11:42Z

/retest

openshift-ci · 2026-09-21T13:11:58Z

@nikitapal-12: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

nikitapal-12 · 2026-09-21T13:21:56Z

/retest-required

openshift-ci · 2026-09-21T14:35:10Z

@nikitapal-12: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-bitbucket-no-pat-oauth-flow-ssh-url	`bb8a8e6`	link	true	`/test v19-bitbucket-no-pat-oauth-flow-ssh-url`
ci/prow/v19-gitea-with-pat-setup-flow	`bb8a8e6`	link	true	`/test v19-gitea-with-pat-setup-flow`
ci/prow/v19-github-no-pat-oauth-flow-ssh-url	`bb8a8e6`	link	true	`/test v19-github-no-pat-oauth-flow-ssh-url`
ci/prow/v19-azure-with-pat-setup-flow	`bb8a8e6`	link	true	`/test v19-azure-with-pat-setup-flow`
ci/prow/v19-bitbucket-no-pat-oauth-flow	`bb8a8e6`	link	true	`/test v19-bitbucket-no-pat-oauth-flow`
ci/prow/v19-gitlab-with-oauth-setup-flow	`bb8a8e6`	link	true	`/test v19-gitlab-with-oauth-setup-flow`
ci/prow/v19-gitea-no-pat-oauth-flow	`bb8a8e6`	link	true	`/test v19-gitea-no-pat-oauth-flow`
ci/prow/v19-github-no-pat-oauth-flow-raw-devfile-url	`bb8a8e6`	link	true	`/test v19-github-no-pat-oauth-flow-raw-devfile-url`
ci/prow/v19-github-with-pat-setup-flow	`bb8a8e6`	link	true	`/test v19-github-with-pat-setup-flow`
ci/prow/v19-gitlab-no-pat-oauth-flow-ssh-url	`bb8a8e6`	link	true	`/test v19-gitlab-no-pat-oauth-flow-ssh-url`
ci/prow/v19-bitbucket-no-pat-oauth-flow-raw-devfile-url	`bb8a8e6`	link	true	`/test v19-bitbucket-no-pat-oauth-flow-raw-devfile-url`
ci/prow/v19-github-no-pat-oauth-flow	`bb8a8e6`	link	true	`/test v19-github-no-pat-oauth-flow`
ci/prow/v19-azure-no-pat-oauth-flow	`bb8a8e6`	link	true	`/test v19-azure-no-pat-oauth-flow`
ci/prow/v19-gitlab-no-pat-oauth-flow-raw-devfile-url	`bb8a8e6`	link	true	`/test v19-gitlab-no-pat-oauth-flow-raw-devfile-url`
ci/prow/v19-azure-no-pat-oauth-flow-raw-devfile-url	`bb8a8e6`	link	true	`/test v19-azure-no-pat-oauth-flow-raw-devfile-url`
ci/prow/v19-gitlab-no-pat-oauth-flow	`bb8a8e6`	link	true	`/test v19-gitlab-no-pat-oauth-flow`
ci/prow/v19-che-smoke-test	`bb8a8e6`	link	true	`/test v19-che-smoke-test`
ci/prow/v19-azure-no-pat-oauth-flow-ssh-url	`bb8a8e6`	link	true	`/test v19-azure-no-pat-oauth-flow-ssh-url`
ci/prow/v19-gitlab-with-pat-setup-flow	`bb8a8e6`	link	true	`/test v19-gitlab-with-pat-setup-flow`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

svor · 2026-09-23T09:10:27Z

@nikitapal-12 thank you for contribution!
since the PR is opened from fork, it is expected to have failed PR checks
Could you please add instructions How to test this PR? into the description

nikitapal-12 · 2026-09-23T11:53:34Z

@svor
I have updated the section "How to test PR"

svor

LGTM
I've added a grop with name NEW GROUP:

apiVersion: user.openshift.io/v1
kind: Group
metadata:
  name: NEW GROUP
users:
  - cluster-admin

Enabled advanced authorization in CheCluster

  networking:
    auth:
      advancedAuthorization:
        allowGroups:
          - NEW GROUP

Patched CheCluster to use che-server image built from the PR:
quay.io/vsvydenk/che-server:next

And I was able to login to the dashboard without errors:

openshift-ci · 2026-09-23T12:56:01Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ibuziuk, nikitapal-12, svor, tolusha, vinokurig

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

vinokurig · 2026-09-23T13:22:40Z

@nikitapal-12 Please run mvn fmt:format to fix the build

openshift-ci · 2026-09-24T05:00:48Z

New changes are detected. LGTM label has been removed.

coderabbitai · 2026-09-24T05:01:08Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 403b0bd6-8efe-483e-9265-fb989a4864b3

📥 Commits

Reviewing files that changed from the base of the PR and between f1b2f32 and 281a879.

📒 Files selected for processing (2)

infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerImpl.java
infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

📝 Walkthrough

Walkthrough

OpenShift authorization checks now encode group names as URL path segments before fetching groups. Tests cover percent-encoding spaces and authorization for members and non-members of a group whose name contains spaces.

Changes

OpenShift group lookup

Layer / File(s)	Summary
Encode group names for lookups `infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerImpl.java`, `infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java`	The allow-group and deny-group lookups use a helper that encodes group names as URL path segments. Tests check percent-encoding and authorization for members and non-members of a group with spaces in its name.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 281a8

Group names containing spaces are encoded for the OpenShift lookup; no remaining issue is established that would prevent merging after normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: encoding OpenShift group names for advanced authorization.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

svor · 2026-09-24T11:33:15Z

@nikitapal-12 please sign ECA

svor · 2026-09-24T11:34:12Z

@nikitapal-12 please sign ECA

nikitapal-12 requested review from SDawley, ibuziuk, tolusha and vinokurig as code owners September 21, 2026 11:24

openshift-ci Bot added the needs-ok-to-test label Sep 21, 2026

tolusha approved these changes Sep 21, 2026

View reviewed changes

openshift-ci Bot assigned tolusha Sep 21, 2026

openshift-ci Bot added the lgtm label Sep 21, 2026

ibuziuk approved these changes Sep 23, 2026

View reviewed changes

openshift-ci Bot assigned ibuziuk Sep 23, 2026

svor approved these changes Sep 23, 2026

View reviewed changes

openshift-ci Bot assigned svor Sep 23, 2026

vinokurig approved these changes Sep 23, 2026

View reviewed changes

openshift-ci Bot assigned vinokurig Sep 23, 2026

fix: apply google-java-format to authorization changes

281a879

openshift-ci Bot removed the lgtm label Sep 24, 2026

Conversation

nikitapal-12 commented Sep 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

PR Checklist

Release Notes

Reviewers

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Sep 21, 2026

Uh oh!

tolusha commented Sep 21, 2026

Uh oh!

nikitapal-12 commented Sep 21, 2026

Uh oh!

openshift-ci Bot commented Sep 21, 2026

Uh oh!

nikitapal-12 commented Sep 21, 2026

Uh oh!

openshift-ci Bot commented Sep 21, 2026

Uh oh!

svor commented Sep 23, 2026

Uh oh!

nikitapal-12 commented Sep 23, 2026

Uh oh!

svor left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Sep 23, 2026

Uh oh!

vinokurig commented Sep 23, 2026

Uh oh!

openshift-ci Bot commented Sep 24, 2026

Uh oh!

coderabbitai Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

svor commented Sep 24, 2026

Uh oh!

svor commented Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nikitapal-12 commented Sep 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading