Bug 1258512
| Summary: | RBAC: Group context switching affecting provisioning best-fit placement, quota and group ownership | ||
|---|---|---|---|
| Product: | Red Hat CloudForms Management Engine | Reporter: | Chris Pelland <cpelland> |
| Component: | Automate | Assignee: | Keenan Brock <kbrock> |
| Status: | CLOSED ERRATA | QA Contact: | Jeff Teehan <jteehan> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 5.3.0 | CC: | cpelland, dajohnso, david.costakos, fdupont, gmccullo, jhardy, jteehan, kbrock, kmorey, mfeifer, mkanoor, obarenbo, tfitzger, xlecauch |
| Target Milestone: | GA | Keywords: | ZStream |
| Target Release: | 5.4.3 | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | |||
| Fixed In Version: | 5.4.3.0 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1187777 | Environment: | |
| Last Closed: | 2015-10-22 14:33:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1187777 | ||
| Bug Blocks: | |||
|
Comment 1
Greg McCullough
2015-09-29 17:14:06 UTC
Hello Aziza or Jeff, This is tricky to test, since our UI currently does not allow us to assign multiple groups to a user. This tends to be an LDAP only feature. But if you do not have LDAP available, then you can modify a user in rails console: u = User.first g1 = MiqGroup.first g2 = MiqGroup.last u.update_attributes(:current_group => g1, :miq_groups => [g1, g2]) In the UI, the upper right corner should give you the ability to change a user's group. This will change the current_group value in the user's record in the database. If the UI does not have a drop down, try logging out and back in again. Let me know if this helps you. --Keenan I think I got it all correct. We can double check on https://10.8.59.221/miq_request/show_list I setup the environment as described. Starting with a group that allowed me to provision a VM, I started a provision request. Immediately I toggled "Change Group ->" to the group that does not allow the user to provision on that host. This had no impact on the request and the VM was created as requested. User is jteehan/smartvm It should be noted that upon completion, the user did not have access to that VM until switched back to a Group which did allow access. All the requests and logs will be preserved on the above VM until 5.4.3 is officially released. I'll leave this in ON_QA for a bit should anyone which to comment. This is still working per the instructions. Moving to Verified. Will also need to check in 5.5 for the cloned bug. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1916.html |