Cloudron SSO Overwrites Traccar Admin Permissions

[hakunamatata]

Environment

• Cloudron Version: 9.1.3
• App: Traccar 6.12.2
• User Management: Enabled (Cloudron SSO)

Description

When a user logs in via Cloudron SSO, their administrative permissions within Traccar are automatically reverted to a standard "User" status. Even after manually elevating the user in the database (setting administrator = 1 and userlimit = -1 in the tc_users table), the changes are overwritten the moment the user authenticates via SSO or the app is restarted.

This creates a persistent "Write Access Denied" state for the primary administrator, preventing the management of devices, geofences, or server settings.

Steps to Reproduce

1. Install Traccar on Cloudron with User Management (SSO) enabled.

2. Login via SSO (Initial status is a standard user).

3. Manually elevate the user to admin in the Traccar UI.

4. Confirm Admin access is active in the Traccar UI (Settings and Server menus are visible).

5. Log out and log back in via Cloudron SSO, or restart the app.

6. The user's administrator status in tc_users is reverted to 0x00, and administrative access is lost.

SQL: SELECT email, administrator FROM tc_users WHERE email = '[redacted]';

Expected Behavior
The Cloudron SSO sync should respect existing administrator flags within the Traccar database.

[nebulon]

Thanks for the bugreport, this is easy to reproduce just looking for a fix now.

[hakunamatata]

The bug must be relatively recent because I was able to add a device on March 5th when I was running Traccar 6.12.0. Cloudron instance was updated to 9.1.3 on March 7th.

Today I went in to add some more devices and experienced the aforementioned issue.

[nebulon]

So it turns out the traccar code always resets the role for a user on login. Because Cloudron does not expose the user role from Cloudron itself (like if a user is admin or not on the Cloudron), traccar assumes all users are normal users. Generally we do not expose user roles via OpenID, since the roles on Cloudron are usually not mapping well to an app. It looks like their implementation is more designed for ActiveDirectory/LDAP style usage, where such info is usually stored with the directory and can be configured per client/app.

We will see if some upstream fix can be made and would be accepted.

[hakunamatata]

Temporary work-around for anyone experiencing the same issue:

1. Access the SQL DB via the Cloudron App Terminal
2. Manually elevate the user via SQL:

UPDATE tc_users SET administrator = 1, userlimit = -1 WHERE email = 'user@domain.com'

3. Do whatever admin tasks you need to do, noting that admin permissions will be removed at next login or app restart.