Bug 1313904

Summary: When an AD group is assigned superuser access to a cluster, users in that group are not given access to the VMs in that cluster
Product: Red Hat Enterprise Virtualization Manager Reporter: Allie DeVolder <adevolder>
Component: ovirt-engineAssignee: Arik <ahadas>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: 3.5.7CC: adevolder, ahadas, gklein, lsurette, mgoldboi, michal.skrivanek, mperina, oourfali, rbalakri, Rhev-m-bugs, srevivo, tjelinek, ykaul
Target Milestone: ovirt-4.0.4   
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-08-15 06:52:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: Virt RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1320343    

Description Allie DeVolder 2016-03-02 15:15:51 UTC
Description of problem:
When an AD group is assigned superuser access to a cluster, users in that group are not given access to the VMs in that cluster

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Assign a group 'superuser' role on a cluster
2. log in as member of that group
3. attempt to access VM in that cluster

Actual results:
User not given access to that VM

Expected results:
User should have access to the VM as per the cluster settings

Comment 1 Oved Ourfali 2016-03-03 06:24:05 UTC
Can you elaborate what do you mean by access to VM?

Comment 3 Tomas Jelinek 2016-03-07 09:33:46 UTC
@Arik, any thoughts?

Comment 4 Arik 2016-04-10 13:42:04 UTC
(In reply to Tomas Jelinek from comment #3)
> @Arik, any thoughts?

It seems that by design admin roles are not inherited from clusters to VMs.
Therefore it is definitely not something for a z-stream.

Allan, could you please elaborate on the implication on the user? is something missing in the UI? are there specific operations the user cannot do because of this?

Comment 5 Tomas Jelinek 2016-04-14 12:33:26 UTC
since it is by design pushing out of 3.6.6.
Setting to 4.0 in case we will get to some enhancement we want to implement.

Comment 6 Yaniv Lavi 2016-05-09 11:00:50 UTC
oVirt 4.0 Alpha has been released, moving to oVirt 4.0 Beta target.

Comment 15 Michal Skrivanek 2016-07-21 12:10:47 UTC
this works as per design. We need to review the design

Comment 16 Michal Skrivanek 2016-07-28 07:53:47 UTC
is there any input/feedback from infra about how roles work?

Comment 22 Tomas Jelinek 2016-08-15 06:52:25 UTC
As explained by infra in comment 21: There is a difference if you use the user level api or admin level (e.g. the UI user portal vs webadmin; in REST Filter: true vs false header).
If you use the user level API, you need to assign user roles (in this case UserVmManager, not superuser).

This is by design, closing as not a bug.
If this is a big issue or someone has a good use case to change it, please reopen as RFE.