Verify athenz tenant before evaluating developer role privileges

1 files changed, 2 insertions, 1 deletions

diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/AthenzRoleFilter.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/AthenzRoleFilter.java
index da048e6b569..766a51e3e8d 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/AthenzRoleFilter.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/filter/AthenzRoleFilter.java
@@ -152,7 +152,8 @@ public class AthenzRoleFilter extends JsonSecurityRequestFilterBase {
             && application.isPresent()) {
             ZoneId z = zone.get();
             futures.add(executor.submit(() -> {
-                if (canDeployToManualZones(identity, ((AthenzTenant) tenant.get()).domain(), application.get(), z))
+                if (tenant.get().type() == Tenant.Type.athenz
+                    && canDeployToManualZones(identity, ((AthenzTenant) tenant.get()).domain(), application.get(), z))
                     roleMemberships.add(Role.hostedDeveloper(tenant.get().name()));
             }));
         }