|Summary:||RBAC: Control element visibility for users with multiple scoped roles|
|Product:||[JBoss] JBoss Enterprise Application Platform 6||Reporter:||Jakub Cechacek <jcechace>|
|Component:||Web Console||Assignee:||Harald Pehl <hpehl>|
|Status:||CLOSED CURRENTRELEASE||QA Contact:||Jakub Cechacek <jcechace>|
|Severity:||urgent||Docs Contact:||Russell Dickenson <rdickens>|
|Version:||6.2.0||CC:||brian.stansberry, hpehl, jcechace, jkudrnac, kkhan, lcosti, lthon, myarboro, rdickens, smumford|
|Target Release:||EAP 6.3.0|
|Fixed In Version:||Doc Type:||Bug Fix|
Users assigned to multiple roles would see operations in the console that they did not have access to perform. For example, a user with roles *host-master-administrator* and *host-slave-monitor* should only have been able to see control elements (such as the *Add* button on the server configurations page) in context of host slave. This button should not have been visible when operating in context of host master (however it was). Operations that were incorrectly visible would fail if attempted, as the correct access control was enforced in the execution of the operation. There was no security violation. This issue in the management console has been fixed in this release. Control elements which are not relevant for a user role, while visible, are 'grayed-out' and are not active.
|Last Closed:||2014-06-28 15:39:52 UTC||Type:||Bug|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||1074493|
Description Jakub Cechacek 2013-10-01 14:24:39 UTC
Control elements are visible whenever it is required by one of user's roles regarding current host / group Context. Lets say we have user with roles "host-master-administrator" and "host-slave-monitor". This user should be able to see control elements (such as "Add" button on server configurations page) only in context of host slave, when operating in context of host master this button should not be visible. For server groups things are more complicated as all groups are listed on one page. Thus making buttons enabled / disabled based on selected resource might be a better solution
Comment 4 John Doyle 2013-10-03 08:22:29 UTC
So the user experience would be that the button is visible in a context when it should not be, but the operation will fail if the user attempts it?
Comment 5 Jakub Cechacek 2013-10-03 08:42:06 UTC
Comment 6 John Doyle 2013-10-03 08:55:42 UTC
If we cannot resolve this issue with our current timeline, we should defer.
Comment 7 John Doyle 2013-10-17 02:40:09 UTC
Added text for a known issue.
Comment 8 Heiko Braun 2013-10-21 11:41:21 UTC
It's a known issue, that has already been postponed. See above.
Comment 10 John Doyle 2013-10-21 16:08:18 UTC
Acknowledged. I already added text for the release note.
Comment 11 Ladislav Thon 2013-10-21 16:36:09 UTC
The original report, and in consequence also the Doc Text, is wrong in one detail: the control elements should only be visible in context of host _master_ (as for this host, the user is in the administrator role). Jakub, please confirm.
Comment 12 Jakub Cechacek 2013-10-22 06:57:59 UTC
That's true, I've accidentally switched the context in my description. Russell, can you correct the Doc Text please?
Comment 13 Scott Mumford 2013-12-02 01:55:43 UTC
Modified Doc Text content (appears to gel with Jakub's comment 12) and marked for inclusion in 6.2 Release Notes document.
Comment 14 Kabir Khan 2014-03-06 16:40:48 UTC
Part of this is done by https://github.com/jbossas/jboss-eap/pull/1024
Comment 15 JBoss JIRA Server 2014-03-14 01:23:46 UTC
Harald Pehl <email@example.com> updated the status of jira HAL-238 to Resolved
Comment 18 Jakub Cechacek 2014-04-16 10:12:28 UTC