fix(auth): handling logged-in user with no roles (#1589)

Fix #1586
tchiotludo · Nov 19, 2023 · 4d031f9 · 4d031f9
1 parent 8214a11
commit 4d031f9
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 13 deletions.
diff --git a/client/src/containers/Login/Login.jsx b/client/src/containers/Login/Login.jsx
@@ -68,18 +68,22 @@ class Login extends Form {
     const currentUserData = res.data;
 
     if (currentUserData.logged) {
-      sessionStorage.setItem('login', true);
-      sessionStorage.setItem('user', currentUserData.username);
-      sessionStorage.setItem('roles', organizeRoles(currentUserData.roles));
-
-      const returnTo = sessionStorage.getItem('returnTo');
-      sessionStorage.removeItem('returnTo');
-
-      this.props.history.push({
-        pathname: returnTo || '/ui'
-      });
-
-      window.location.reload(true);
+      if (currentUserData.roles) {
+        sessionStorage.setItem('login', true);
+        sessionStorage.setItem('user', currentUserData.username);
+        sessionStorage.setItem('roles', organizeRoles(currentUserData.roles));
+
+        const returnTo = sessionStorage.getItem('returnTo');
+        sessionStorage.removeItem('returnTo');
+
+        this.props.history.push({
+          pathname: returnTo || '/ui'
+        });
+
+        window.location.reload(true);
+      } else {
+        toast.error('User logged in but no roles assigned');
+      }
     } else {
       toast.error('Wrong Username or Password!');
     }

diff --git a/src/main/java/org/akhq/controllers/AbstractController.java b/src/main/java/org/akhq/controllers/AbstractController.java
@@ -60,7 +60,8 @@ protected List<Group> getUserGroups() {
             .collect(Collectors.toList());
 
         // Add the default group if there is one
-        if (groupBindings.isEmpty() && StringUtils.isNotEmpty(securityProperties.getDefaultGroup())) {
+        if (groupBindings.isEmpty() && StringUtils.isNotEmpty(securityProperties.getDefaultGroup())
+            && securityProperties.getGroups().get(securityProperties.getDefaultGroup()) != null) {
             groupBindings.addAll(securityProperties.getGroups().get(securityProperties.getDefaultGroup()));
         }