diff --git a/src/Core/Authorization/AuthorizationResolver.cs b/src/Core/Authorization/AuthorizationResolver.cs index 93e4622f29..79b9cd0888 100644 --- a/src/Core/Authorization/AuthorizationResolver.cs +++ b/src/Core/Authorization/AuthorizationResolver.cs @@ -136,7 +136,17 @@ public bool AreColumnsAllowedForOperation(string entityName, string roleName, En if (!EntityPermissionsMap[entityName].RoleToOperationMap.TryGetValue(roleName, out RoleMetadata? roleMetadata) && roleMetadata is null) { - return false; + if (ROLE_ANONYMOUS.Equals(roleName, StringComparison.OrdinalIgnoreCase) || + ROLE_AUTHENTICATED.Equals(roleName, StringComparison.OrdinalIgnoreCase)) + { + return false; + } + + // roleName is a custom role and derives from authenticated role. Let's try with authenticated role. + if (!EntityPermissionsMap[entityName].RoleToOperationMap.TryGetValue(ROLE_AUTHENTICATED, out roleMetadata) && roleMetadata is null) + { + return false; + } } // Short circuit when OperationMetadata lookup fails. When lookup succeeds, operationToColumnMap will be populated