Bug 1235541

Summary: OpenStack tenant visibility not limited by tag
Product: Red Hat CloudForms Management Engine Reporter: Eduardo Minguez <eminguez>
Component: UI - OPSAssignee: Harpreet Kataria <hkataria>
Status: CLOSED ERRATA QA Contact: Pete Savage <psavage>
Severity: high Docs Contact:
Priority: high    
Version: 5.4.0CC: cpelland, gblomqui, hkataria, jfrey, jhardy, jocarter, lsmola, mfeifer, mpovolny, ncatling, obarenbo
Target Milestone: GAKeywords: FutureFeature, ZStream
Target Release: 5.5.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 5.5.0.1 Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
: 1245682 (view as bug list) Environment:
Last Closed: 2015-12-08 13:19:01 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1245682, 1247289    

Description Eduardo Minguez 2015-06-25 06:47:48 UTC
Description of problem:
Users with "View" capabilities of tenants, can see all tenants, even if they are not tagged and the user is limited to some tags

Version-Release number of selected component (if applicable):
CF3.2

How reproducible:
Create a user with limited tag visibility and tenant view permissions, attach to an openstack provider, do not tag any tenant and the user will see all tenants.

Steps to Reproduce:
1. Create a user with limited tag visibility and tenant view permissions
2. Attach CF to an openstack provider
3. Do not tag any tenant with the visibility tag for the user

Actual results:
The user can see all tenants

Expected results:
The user only can see the tenants tagged with his visibility tag value

Additional info:
Attached screenshots

Comment 5 Greg McCullough 2015-07-29 19:43:38 UTC
Dan - This ticket is focusing on applying RBAC to the UI screens.  

There is a similar issue for the provisioning dialogs and I opened Bug 1248181 to address that issue.

Comment 6 Ladislav Smola 2015-07-31 08:53:50 UTC
Just a note, I noticed this on other places too, e.g. stacks, flavors. So might be wider issue.

Also I noticed that if I assign tag to a certain image, I can see it in image list. But when I want to provision Instance, the image list there is empty, so I can't provision.

Comment 8 Harpreet Kataria 2015-08-04 19:28:45 UTC
*** Bug 1250232 has been marked as a duplicate of this bug. ***

Comment 9 CFME Bot 2015-08-05 01:11:40 UTC
New commit detected on manageiq/master:
https://github.com/ManageIQ/manageiq/commit/d3d68c925879d081d3844fef20b045670c13cf81

commit d3d68c925879d081d3844fef20b045670c13cf81
Author:     Harpreet Kataria <hkataria>
AuthorDate: Mon Aug 3 09:29:16 2015 -0400
Commit:     Harpreet Kataria <hkataria>
CommitDate: Mon Aug 3 09:29:16 2015 -0400

    Added missing classes to CLASSES_THAT_PARTICIPATE_IN_RBAC list
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1235541

 app/models/rbac.rb | 7 +++++++
 1 file changed, 7 insertions(+)

Comment 10 CFME Bot 2015-08-06 17:41:18 UTC
New commit detected on cfme/5.4.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=41a45cf7d41ce0fb8e7094996ea5e5418315001c

commit 41a45cf7d41ce0fb8e7094996ea5e5418315001c
Author:     Harpreet Kataria <hkataria>
AuthorDate: Wed Aug 5 09:21:32 2015 -0400
Commit:     Harpreet Kataria <hkataria>
CommitDate: Wed Aug 5 09:21:32 2015 -0400

    Added missing classes to CLASSES_THAT_PARTICIPATE_IN_RBAC list
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1235541
    https://bugzilla.redhat.com/show_bug.cgi?id=1245682

 vmdb/app/models/rbac.rb | 7 +++++++
 1 file changed, 7 insertions(+)

Comment 11 CFME Bot 2015-08-06 17:41:26 UTC
New commit detected on cfme/5.4.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=11d5ec0be786e910fffdedee3ad9d31a0e700458

commit 11d5ec0be786e910fffdedee3ad9d31a0e700458
Merge: 8522494 41a45cf
Author:     Dan Clarizio <dclarizi>
AuthorDate: Thu Aug 6 13:36:21 2015 -0400
Commit:     Dan Clarizio <dclarizi>
CommitDate: Thu Aug 6 13:36:21 2015 -0400

    Merge branch '54z_bz_1245682' into '5.4.z'
    
    Added missing classes to CLASSES_THAT_PARTICIPATE_IN_RBAC list
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1235541
    https://bugzilla.redhat.com/show_bug.cgi?id=1245682
    
    @dclarizio please review/merge, clean patch was applied.
    Original PR: https://github.com/ManageIQ/manageiq/pull/3691
    
    See merge request !211

 vmdb/app/models/rbac.rb | 7 +++++++
 1 file changed, 7 insertions(+)

Comment 12 Marianne Feifer 2015-08-10 18:35:31 UTC
See BZ 1245682

Comment 13 Pete Savage 2015-10-26 19:10:06 UTC
Verified in 5.5.0.7

Comment 15 errata-xmlrpc 2015-12-08 13:19:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2015:2551