{"action":"created","issue":{"url":"https://api.github.com/repos/TykTechnologies/tyk/issues/298","repository_url":"https://api.github.com/repos/TykTechnologies/tyk","labels_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/298/labels{/name}","comments_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/298/comments","events_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/298/events","html_url":"https://github.com/TykTechnologies/tyk/issues/298","id":178903448,"number":298,"title":"Bug: Wrong policy enforced for connectid client.  UI shows different policy than what is being used.","user":{"login":"ryanwalls","id":842653,"avatar_url":"https://avatars.githubusercontent.com/u/842653?v=3","gravatar_id":"","url":"https://api.github.com/users/ryanwalls","html_url":"https://github.com/ryanwalls","followers_url":"https://api.github.com/users/ryanwalls/followers","following_url":"https://api.github.com/users/ryanwalls/following{/other_user}","gists_url":"https://api.github.com/users/ryanwalls/gists{/gist_id}","starred_url":"https://api.github.com/users/ryanwalls/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryanwalls/subscriptions","organizations_url":"https://api.github.com/users/ryanwalls/orgs","repos_url":"https://api.github.com/users/ryanwalls/repos","events_url":"https://api.github.com/users/ryanwalls/events{/privacy}","received_events_url":"https://api.github.com/users/ryanwalls/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-09-23T15:15:52Z","updated_at":"2016-09-23T15:29:02Z","closed_at":null,"body":"I'm using Tyk Cloud.  My account is `3dsim.cloud.tyk.io`.  \r\n\r\nOn API 57e53aca201ad30001000014, client id `https://workflow-qa.3dsim.com` is matched with policy 57e53daf9b111c000100000b.  \r\n\r\nIn reality, the policy that is actually being enforced is 57dd90449d0210000100003a.  \r\n\r\n\r\nI believe the steps I took to get to this state are as follows:\r\n\r\n1.  Create new api that is set to use connectid for auth.\r\n2.  Add client with id `https://workflow-qa.3dsim.com` and associate with policy 57dd90449d0210000100003a.\r\n3.  Save\r\n4.  Delete the client that was just added\r\n5.  Save\r\n6.  Add the client back using same id `https://workflow-qa.3dsim.com` and associate with policy 57e53daf9b111c000100000b.  \r\n7.  Save\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/TykTechnologies/tyk/issues/comments/249223840","html_url":"https://github.com/TykTechnologies/tyk/issues/298#issuecomment-249223840","issue_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/298","id":249223840,"user":{"login":"lonelycode","id":2444409,"avatar_url":"https://avatars.githubusercontent.com/u/2444409?v=3","gravatar_id":"","url":"https://api.github.com/users/lonelycode","html_url":"https://github.com/lonelycode","followers_url":"https://api.github.com/users/lonelycode/followers","following_url":"https://api.github.com/users/lonelycode/following{/other_user}","gists_url":"https://api.github.com/users/lonelycode/gists{/gist_id}","starred_url":"https://api.github.com/users/lonelycode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lonelycode/subscriptions","organizations_url":"https://api.github.com/users/lonelycode/orgs","repos_url":"https://api.github.com/users/lonelycode/repos","events_url":"https://api.github.com/users/lonelycode/events{/privacy}","received_events_url":"https://api.github.com/users/lonelycode/received_events","type":"User","site_admin":false},"created_at":"2016-09-23T15:29:02Z","updated_at":"2016-09-23T15:29:02Z","body":"The case here is that Tyk has generated an internal representation for this identity (sub), and this identity has the matched policy ID set. Changing the policy ID it at the client level will not affect an *existing* user (a sub that Tyk has seen before), changing the policy itself will though. \r\n\r\nSee [this documentation article](https://tyk.io/tyk-documentation/security/your-apis/openid-connect/), in particular step 8.\r\n\r\nWhat has happened is that your JWT has generated an internal representation and Tyk will not update the policy based on the client, but you can update the policy on the internal representation (to get this, inject a header with the value of `$tyk_meta.TykJWTSessionID` and edit this token).\r\n\r\nI hope that makes sense.\r\n\r\n"}}
{"actor":{"display_login":"lonelycode"}}