With the simplest docker setup, using the team Automation with permissions: BOM_UPLOAD, PORTFOLIO_MANAGEMENT and PROJECT_CREATION_UPLOAD it is not possible to PUT a new project BOM. The project always errors into The principal does not have permission to create project.
* Preparing request to https://dtrack-apiserver/api/v1/bom
* Current time is 2022-11-18T09:58:27.610Z
* Enable automatic URL encoding
* Using default HTTP version
* Disable SSL validation
* Found bundle for host dtrack-apiserver: XXX [can multiplex]
* Re-using existing connection! (#17) with host dtrack-apiserver
* Connected to dtrack-apiserver XXX
* Using Stream ID: 3 (easy handle XXX)
> PUT /api/v1/bom HTTP/2
> Host: dtrack-apiserver
> user-agent: insomnia/2022.6.0
> x-api-key: XXXXXXXXXXXX
> content-type: application/json
> accept: */*
> content-length: 81
| {"autoCreate":true,"projectName":"my project","projectVersion":"23.4","bom":""}
* We are completely uploaded and fine
< HTTP/2 401
< date: Fri, 18 Nov 2022 09:58:27 GMT
< content-type: application/json
< x-powered-by: Dependency-Track v4.6.3
< cache-control: private, max-age=0, must-revalidate, no-cache
< access-control-allow-origin: *
< access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
< access-control-allow-headers: Origin, Content-Type, Authorization, X-Requested-With, Content-Length, Accept, Origin, X-Api-Key, X-Total-Count, *
< access-control-expose-headers: Origin, Content-Type, Authorization, X-Requested-With, Content-Length, Accept, Origin, X-Api-Key, X-Total-Count
< access-control-allow-credentials: true
< access-control-max-age: 3600
< content-length: 57
< referrer-policy: no-referrer-when-downgrade
< content-security-policy: default-src https: mailto: designers: helpdesks: 'unsafe-inline' 'unsafe-eval'; img-src https: data: blob:; connect-src wss: https:
< x-frame-options: SAMEORIGIN
< x-content-type-options: nosniff
< x-xss-protection: 1; mode=block
< strict-transport-security: max-age=15768000; includeSubDomains; preload
* Received 57 B chunk
* Connection #17 to host dtrack-apiserver left intact
Current Behavior
With the simplest docker setup, using the team Automation with permissions: BOM_UPLOAD, PORTFOLIO_MANAGEMENT and PROJECT_CREATION_UPLOAD it is not possible to PUT a new project BOM. The project always errors into
The principal does not have permission to create project.Insomnia log:
Steps to Reproduce
Expected Behavior
Project is created
Dependency-Track Version
4.6.2
Dependency-Track Distribution
Container Image
Database Server
N/A
Database Server Version
No response
Browser
N/A
Checklist