I upgraded Pangolin from 1.5.0 to 1.6.2, and now I cannot acces any resource behind Pangolin authentication. Neither with users whose groups are alloved, neither administrators that theoretically can acces everything.
Just a few questions to help me pinpoint:
Are you using PostgreSQL or SQLite version? Are you able to log in to the dashboard but just not the resources themselves? If so, in the dashboard, do the users still exist and are they in your org/added to the resource SSO input box via their role or specific username? Are you using an OIDC IDP?
<!-- gh-comment-id:3030656284 -->
@miloschwartz commented on GitHub (Jul 3, 2025):
Just a few questions to help me pinpoint:
Are you using PostgreSQL or SQLite version? Are you able to log in to the dashboard but just not the resources themselves? If so, in the dashboard, do the users still exist and are they in your org/added to the resource SSO input box via their role or specific username? Are you using an OIDC IDP?
I'm using PostgreSQL.
I'm able to log in to the dashboard, and any resource that has Pangolin authentication is turned off.
I'm using OIDC auth for regular users and the local auth for the admin user. The OIDC users still exits, are able to log in using OIDC, can acces resources that reoly only on OIDC for authentication. And neither can acces the resrouces. Even when specifically added to the Users section.
Also, the Allow rules are working too, for example an alloved API acces using /api/* still works.
The only acces problems are limited to resources with this on for everything protected by Pangolin itself:
<!-- gh-comment-id:3030690304 -->
@theAlevan commented on GitHub (Jul 3, 2025):
I'm using PostgreSQL.
I'm able to log in to the dashboard, and any resource that has Pangolin authentication is turned off.
I'm using OIDC auth for regular users and the local auth for the admin user. The OIDC users still exits, are able to log in using OIDC, can acces resources that reoly only on OIDC for authentication. And neither can acces the resrouces. Even when specifically added to the **Users** section.
Also, the Allow rules are working too, for example an alloved API acces using _/api/*_ still works.
The only acces problems are limited to resources with this on for everything protected by Pangolin itself:
When you see the Access Denied page can you check the browser network tools and find the request: GET /resource/<id> and let me know what the full response was?
<!-- gh-comment-id:3030762870 -->
@miloschwartz commented on GitHub (Jul 3, 2025):
When you see the Access Denied page can you check the browser network tools and find the request: GET `/resource/<id>` and let me know what the full response was?
Could you explain it how to do it?
Or is it one of these?
<!-- gh-comment-id:3030795049 -->
@theAlevan commented on GitHub (Jul 3, 2025):
Could you explain it how to do it?
Or is it one of these?
Open the network tab and then reload the page that shows access denied. I think most likely you'll see a similar response to mine, but I want to see if there is some other error causing this.
<!-- gh-comment-id:3030947753 -->
@miloschwartz commented on GitHub (Jul 3, 2025):
Open the network tab and then reload the page that shows access denied. I think most likely you'll see a similar response to mine, but I want to see if there is some other error causing this.
<img width="1228" alt="Image" src="https://github.com/user-attachments/assets/100a8129-897b-43e7-b348-5979fda4ad95" />
<img width="971" alt="Image" src="https://github.com/user-attachments/assets/e179de98-5c44-434c-a920-67d939ce01c5" />
This is the only item in the list that has the resource ID after refreshing while accessing a blocked resource URL in the Network section:
here is the response:
<!-- gh-comment-id:3032826735 -->
@theAlevan commented on GitHub (Jul 3, 2025):
This is the only item in the list that has the resource ID after refreshing while accessing a blocked resource URL in the Network section:
here is the response:
[response.txt](https://github.com/user-attachments/files/21041202/response.txt)
@github-actions[bot] commented on GitHub (Jul 18, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:3086063511 -->
@github-actions[bot] commented on GitHub (Jul 18, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Aug 1, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
<!-- gh-comment-id:3141739428 -->
@github-actions[bot] commented on GitHub (Aug 1, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @theAlevan on GitHub (Jul 3, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1003
I upgraded Pangolin from 1.5.0 to 1.6.2, and now I cannot acces any resource behind Pangolin authentication. Neither with users whose groups are alloved, neither administrators that theoretically can acces everything.
Log entry:
2025-07-03T04:07:10.169Z [info]: Resource access not allowed. Resource ID: 51. IP: 86.125.60.190.
2025-07-03T04:07:37.180Z [info]: Resource access not allowed. Resource ID: 26. IP: 86.126.196.210.
2025-07-03T04:08:37.061Z [info]: Resource access not allowed. Resource ID: 26. IP: 86.126.196.210.
2025-07-03T04:09:37.072Z [info]: Resource access not allowed. Resource ID: 26. IP: 86.126.196.210.
2025-07-03T04:10:37.071Z [info]: Resource access not allowed. Resource ID: 26. IP: 86.126.196.210.
2025-07-03T04:10:49.086Z [info]: Resource access not allowed. Resource ID: 10. IP: 86.125.60.190.
2025-07-03T04:11:37.077Z [info]: Resource access not allowed. Resource ID: 26. IP: 86.126.196.210.
Screenshot:
@miloschwartz commented on GitHub (Jul 3, 2025):
Just a few questions to help me pinpoint:
Are you using PostgreSQL or SQLite version? Are you able to log in to the dashboard but just not the resources themselves? If so, in the dashboard, do the users still exist and are they in your org/added to the resource SSO input box via their role or specific username? Are you using an OIDC IDP?
@theAlevan commented on GitHub (Jul 3, 2025):
I'm using PostgreSQL.
I'm able to log in to the dashboard, and any resource that has Pangolin authentication is turned off.
I'm using OIDC auth for regular users and the local auth for the admin user. The OIDC users still exits, are able to log in using OIDC, can acces resources that reoly only on OIDC for authentication. And neither can acces the resrouces. Even when specifically added to the Users section.
Also, the Allow rules are working too, for example an alloved API acces using /api/* still works.
The only acces problems are limited to resources with this on for everything protected by Pangolin itself:
@miloschwartz commented on GitHub (Jul 3, 2025):
When you see the Access Denied page can you check the browser network tools and find the request: GET
/resource/<id>and let me know what the full response was?@theAlevan commented on GitHub (Jul 3, 2025):
Could you explain it how to do it?
Or is it one of these?
@miloschwartz commented on GitHub (Jul 3, 2025):
Open the network tab and then reload the page that shows access denied. I think most likely you'll see a similar response to mine, but I want to see if there is some other error causing this.
@theAlevan commented on GitHub (Jul 3, 2025):
This is the only item in the list that has the resource ID after refreshing while accessing a blocked resource URL in the Network section:
here is the response:
response.txt
@github-actions[bot] commented on GitHub (Jul 18, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Aug 1, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.