Bug 1411477

New commit detected on ManageIQ/manageiq/euwe:
https://github.com/ManageIQ/manageiq/commit/c180299f056015b1d11e0ec6a1ce82db95493ad4

commit c180299f056015b1d11e0ec6a1ce82db95493ad4
Author:     Greg McCullough <gmccullo>
AuthorDate: Mon Dec 5 09:59:53 2016 -0500
Commit:     Satoe Imaishi <simaishi>
CommitDate: Mon Jan 9 14:55:41 2017 -0500

    Merge pull request #12369 from mkanoor/rbac_tres
    
    RBAC support for Automate Service Models
    (cherry picked from commit b2cd6253905150f3a72d6da98cf0a1b3d8dc91b3)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1411477

 .../engine/drb_remote_invoker.rb                   | 11 +++
 lib/miq_automation_engine/engine/miq_ae_service.rb |  5 ++
 .../engine/miq_ae_service/miq_ae_service_rbac.rb   | 47 ++++++++++++
 .../engine/miq_ae_service_model_base.rb            |  9 ++-
 .../engine/miq_ae_workspace.rb                     | 28 +++++++
 .../engine/drb_remote_invoker_spec.rb              |  4 +-
 .../engine/miq_ae_method_spec.rb                   |  3 +
 .../miq_ae_service/miq_ae_service_rbac_spec.rb     | 87 ++++++++++++++++++++++
 .../miq_automation_engine/miq_ae_service_spec.rb   | 13 +++-
 9 files changed, 201 insertions(+), 6 deletions(-)
 create mode 100644 lib/miq_automation_engine/engine/miq_ae_service/miq_ae_service_rbac.rb
 create mode 100644 spec/lib/miq_automation_engine/engine/miq_ae_service/miq_ae_service_rbac_spec.rb

Fixed via https://github.com/ManageIQ/manageiq/pull/12369 which has been back ported to EUWE

Created attachment 1244936 [details]
all tenants

All tenants are shown not just the tagged one .
Please check https://10.8.199.137.
User :shveta/redhat

This is not supposed to work out of the box.
RBAC is an optional feature and needs to be enabled in Automate methods to filter out items based on the current tenant.

In the Automate method if you want to enable RBAC you would have to use

$evm.enable_rbac

If we enable RBAC by default a lot of customer defined automate method could start to fail. At some later release we will enable RBAC by default.

Method used 
=====================
#
# Description: provide the dynamic list content from available tenants
#
stack_list = {nil => "<default>"}

$evm.enable_rbac

$evm.vmdb('orchestration_stack').all do |os|
  stack_list[os.id] = os.name
end

dialog_field = $evm.object

# sort_by: value / description / none
dialog_field["sort_by"] = "description"

# sort_order: ascending / descending
dialog_field["sort_order"] = "ascending"

# data_type: string / integer
dialog_field["data_type"] = "string"

# required: true / false
dialog_field["required"] = "false"

dialog_field["values"] = stack_list
dialog_field["default_value"] = nil

================================

1) Created a dialog that uses the above method.
2) Created Two tenants :tenant_1 and tenant2 . 
3) Login with tenant_1 (risha/redhat) , Order catalogitem 'tenancy' the dropdown does not show stacks for tenant_1 

Appliance :  https://10.8.199.189

Not working with VM's .
==================Method used===================
#
# Description: provide the dynamic list content from available tenants
#
vm_list = {nil => "<default>"}

$evm.enable_rbac

$evm.log(:info, "VM List")
all_vms = $evm.vmdb('vm').all
$evm.log(:info, "Count #{all_vms.count}")
all_vms.each do |item|
  $evm.log(:info, "item #{item.inspect}")
  #vm_list[item.id] = item.name
end

dialog_field = $evm.object

# sort_by: value / description / none
dialog_field["sort_by"] = "description"

# sort_order: ascending / descending
dialog_field["sort_order"] = "ascending"

# data_type: string / integer
dialog_field["data_type"] = "string"

# required: true / false
dialog_field["required"] = "false"

dialog_field["values"] = vm_list
dialog_field["default_value"] = nil

There seems to be a bug in RBAC, when we enable RBAC using
$evm.enable_rbac

We get a RBAC error
<code: credentials.each do |item|>:38:in `fetch_list_data'
<code: fill_dialog_field(fetch_list_data)>:18:in `main'
[----] E, [2017-02-20T16:53:38.087908 #5140:3fe5a4f8baf0] ERROR -- : Method STDERR: (druby://127.0.0.1:54665) /Users/xxxxx/devsrc/manageiq/lib/rbac/filterer.rb:201:in `collect': undefined method `id' for "bd-test-change":String (NoMethodError)
[----] E, [2017-02-20T16:53:38.088394 #5140:3fe5a4f8baf0] ERROR -- : Method STDERR:   from (druby://127.0.0.1:54665) /Users/xxxx/devsrc/manageiq/lib/rbac/filterer.rb:201:in `search'

The sample Automate method looks like

$evm.enable_rbac
all_vms = $evm.vmdb('vm').all
all_vms.each do |item|
  vm_list[item.id] = item.name
end


When we iterate over each item it blows up

Sure , no problem . 
I will look into it when it comes to ON_QA now.

Hi Shevta,
https://bugzilla.redhat.com/show_bug.cgi?id=1431822

Addresses the concerns in this ticket.
I have create a PR for it which has been merged.
In the next build you should be able to validate this ticket.

Thanks,
Madhu

The PR for https://bugzilla.redhat.com/show_bug.cgi?id=1431822 has been merged please retest

Verification steps :
=======================
Method :
#
# Description: provide the dynamic list content from available tenants
#
vm_list = {nil => "<default>"}

$evm.enable_rbac

$evm.log(:info, "VM List")
all_vms = $evm.vmdb('vm').all
$evm.log(:info, "Count #{all_vms.count}")
all_vms.each do |item|
  $evm.log(:info, "item #{item.inspect}")
  vm_list[item.id] = item.name
end

dialog_field = $evm.object

# sort_by: value / description / none
dialog_field["sort_by"] = "description"

# sort_order: ascending / descending
dialog_field["sort_order"] = "ascending"

# data_type: string / integer
dialog_field["data_type"] = "string"

# required: true / false
dialog_field["required"] = "false"

dialog_field["values"] = vm_list
dialog_field["default_value"] = nil

================================
Create a tenant and a user assigned to that tenant. 
Create a dialog using above method .Call the dialog in a catalog item.
User should see VM's owned by this tenant in dropdown list .

Verified in 5.7.2.0.20170321181409_349f1b1

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:0898