Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1463043

Summary:	Unable to add view role to second user in project
Product:	OpenShift Container Platform	Reporter:	Chris Ryan <cryan>
Component:	apiserver-auth	Assignee:	Jordan Liggitt <jliggitt>
Status:	CLOSED NOTABUG	QA Contact:	Chuan Yu <chuyu>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	aos-bugs, cryan
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-06-20 02:22:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Chris Ryan 2017-06-20 02:01:08 UTC

Description of problem:
Granting a second user 'view' permissions in a project is forbidden

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. Create a project
2. Create an application from the web console, i.e. https://github.com/openshift/nodejs-ex.git
3. Wait until the service is ready and the nodejs-sample-1 build have completed
4. Add the view role to the second user:
oc policy add-role-to-user view user2

Actual results:
Error from server (Forbidden): rolebindings "view" is forbidden: rolebindings to User "user2" are not allowed in project "v2w5c"

Expected results:
The user2 user could be granted view permissions

Additional info:

Comment 2 Chuan Yu 2017-06-20 02:15:12 UTC

Would you please get the output 'oc get rolebindingrestriction' in you project?

Comment 3 Jordan Liggitt 2017-06-20 02:15:22 UTC

Are RoleBindingRestrictions being used in this environment?

https://github.com/openshift/openshift-docs/blob/master/admin_solutions/user_role_mgmt.adoc#role-binding-restriction

Comment 5 Jordan Liggitt 2017-06-20 02:22:42 UTC

so, the default in that environment is that you can only grant access to serviceaccounts in that project, not to other users