Bug 1071687

Summary:	External users unable to live migrate disks to new storage domain
Product:	[Retired] oVirt	Reporter:	Maurice James <midnightsteel>
Component:	ovirt-engine-core	Assignee:	Daniel Erez <derez>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Pavel Stehlik <pstehlik>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	3.3	CC:	acathrow, amureini, derez, gklein, iheim, midnightsteel, oourfali, s.kieske, yeylon
Target Milestone:	---
Target Release:	3.4.1
Hardware:	Unspecified
OS:	Linux
Whiteboard:	storage
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-05-08 13:38:20 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Storage	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Maurice James 2014-03-02 21:35:41 UTC

Description of problem:
LDAP users or groups with the Power User and Super User permissions are unable to migrate storage. Only admin@internal is able to live migrate disks. 

Version-Release number of selected component (if applicable):
3.3

How reproducible:
100%

Steps to Reproduce:
1.Enable external authentication
2.Give specific users or groups the Super User and or Power user role over the data center
3. Attempt to live migrate storage to another storage domain

Actual results:
USER_NOT_AUTHORIZED_TO_PERFORM_ACTION

Expected results:
Disk should migrate to other storage domain

Additional info:

Comment 1 Oved Ourfali 2014-03-03 06:15:50 UTC

PowerUser shouldn't be able to do that.
However, SuperUser on the DC should, assuming that you move the disks to a storage domain in the same DC (iiuc you can't really do that to a different DC).

Comment 2 Maurice James 2014-03-03 12:37:53 UTC

(In reply to Oved Ourfali from comment #1)
> PowerUser shouldn't be able to do that.
> However, SuperUser on the DC should, assuming that you move the disks to a
> storage domain in the same DC (iiuc you can't really do that to a different
> DC).

Yes I'm moving disks between storage domains on the same DC. And like I said in the problem description the admin@internal user has no problems doing so

Comment 3 Allon Mureinik 2014-03-16 12:55:04 UTC

Daniel, please take a look?

Comment 4 Daniel Erez 2014-04-27 16:58:36 UTC

Hi Maurice,

- Can you please attach the relevant engine logs?

- For live migration, a disk should have "Edit Storage" action group (Under: Role -> Disk -> Provisioning Operations). Hence, 'SuperUser' should have sufficient permissions whereas PowerUser shouldn't.

Comment 5 Allon Mureinik 2014-04-28 00:08:16 UTC

(In reply to Daniel Erez from comment #4)
> - For live migration, a disk should have "Edit Storage" action group (Under:
> Role -> Disk -> Provisioning Operations). Hence, 'SuperUser' should have
> sufficient permissions whereas PowerUser shouldn't.

Daniel, AFAIK, these are the same permissions a cold move operation requires. If a Power User can't move a disk, this seems like a bug. 
What am I missing?

Comment 6 Daniel Erez 2014-04-28 06:11:46 UTC

(In reply to Allon Mureinik from comment #5)
> (In reply to Daniel Erez from comment #4)
> > - For live migration, a disk should have "Edit Storage" action group (Under:
> > Role -> Disk -> Provisioning Operations). Hence, 'SuperUser' should have
> > sufficient permissions whereas PowerUser shouldn't.
> 
> Daniel, AFAIK, these are the same permissions a cold move operation
> requires. If a Power User can't move a disk, this seems like a bug. 
> What am I missing?

We're currently not exposing the 'Move' button in the user portal at all,
hence it wasn't needed to add these permissions to a PowerUser.

Comment 7 Sandro Bonazzola 2014-05-08 13:38:20 UTC

This is an automated message

oVirt 3.4.1 has been released:
 * should fix your issue
 * should be available at your local mirror within two days.

If problems still persist, please make note of it in this bug report.

Comment 8 Red Hat Bugzilla 2023-09-14 02:04:23 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days