Bug 1462130

Summary: Administrator checkbox unchecked under Roles tab for External authenticated users (AD+GSS-Proxy+User Groups configured)
Product: Red Hat Satellite Reporter: Nagoor Shaik <nshaik>
Component: LDAPAssignee: Daniel Lobato Garcia <dlobatog>
Status: CLOSED NOTABUG QA Contact: Katello QA List <katello-qa-list>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.2.9CC: mhulan, nshaik, sgraessl, tbrisker
Target Milestone: Unspecified   
Target Release: Unused   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-06-21 09:07:48 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nagoor Shaik 2017-06-16 09:27:27 UTC 
Description of problem:
Administrator checkbox unchecked under Roles tab for External authenticated users (AD+GSS-Proxy+User Groups configured)

Version-Release number of selected component (if applicable):
Red Hat Satellite 6.2.9

How reproducible:
100% 

Steps to Reproduce:
1. Configure Satellite as per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-configuring_external_authentication-using_active_directory

2. Configure User Groups for auto-assignment of roles per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-creating_user_groups-configuring_external_user_groups

3. If a User Group is configured to assign Administrator Role, once the External User logs in, Roles are assigned and user has full access, however when you go to 

My Account >> Roles tab >> Administrator  (checkbox is still unchecked)

Actual results:
Administrator Role is assigned to External user, however Administrator Checkbox is missing on the webUI

Expected results:
Checkbox should also be enabled if a user gets Administrator Role.

Additional info:
Comment 1 Marek Hulan 2017-06-16 13:14:50 UTC 
Thanks for the report Nagoor. I believe this is expected behavior. The Administrator checkbox means that this user is "super admin" regardless of any role his or she is assigned. This flag can't be set on creation by external auth source. Only administrator can mark other users as administrators.

There's a built-in role called Manager though that contains all permissions of Satellite and can be used to delegate administration to users. Once users have Manager role, they can do nearly the same things as these super admins. The only difference is that Managers can't modify Administer -> Settings page which is considered as system settings. Therefore in your case I think that the external group should be linked to an internal user group that has this Manager role. All users within this group should be able to do all tasks.

If they can not, please report each such occurrence as a separate issue. There were some of them, such as non-superadmin can't manage activation keys etc.

Please let me know if that clarifies it. I'm happy to answer further questions but I suggest closing this BZ as NOTABUG.
Comment 3 Marek Hulan 2017-06-21 09:07:48 UTC 
Closing after the confirmation.