Bug 1753907

Summary: The Foreman "forgets" group members after update to 1.22.0
Product: Red Hat Satellite Reporter: Ondřej Ezr <oezr>
Component: LDAPAssignee: Daniel Lobato Garcia <dlobatog>
Status: CLOSED ERRATA QA Contact: Nikhil Kathole <nkathole>
Severity: high Docs Contact:
Priority: unspecified    
Version: 6.4CC: egolov, mhulan, nkathole, zhunting
Target Milestone: 6.6.0Keywords: Regression, Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: foreman-1.22.0.32-1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-10-22 19:48:01 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
After upgrade - screenshot none

Description Ondřej Ezr 2019-09-20 08:26:32 UTC 
I've just updated from 1.21.3 to 1.22.0 and found that users got permission denied messages after logging in, for example because of missing "view_hosts" permissions. After logging in as admin I recognized that the groups didn't have any members anymore. So I added the members again, saved the change, reloaded the group again to verify (members where still there), logged out from admin and logged in as normal user -> No view_hosts permission. Logged back in as admin and saw that the group had no members again.

How reproducible:
always

Steps to Reproduce:
1. Set up LDAP authentication with synchronization enabled
2. Create simple Satellite Usergroup with no external user group link
3. Add users from the LDAP auth source to the Usergroup
4. Log-in as any of the LDAP users aded to the Usergroup

Actual results:
LDAP users are no longer members of the Satellite Usergroup.

Expected results:
No change in the Usergroup memberships.
Comment 1 Ondřej Ezr 2019-09-20 08:26:35 UTC 
Created from redmine issue https://projects.theforeman.org/issues/27402
Comment 2 Ondřej Ezr 2019-09-20 08:26:39 UTC 
Upstream bug assigned to oezr
Comment 6 Nikhil Kathole 2019-09-26 11:39:25 UTC 
VERIFIED

version tested:
Satellite 6.6.0 snap 22

Was able to reproduce the issue with following steps:

On satellite 6.5,

1. Create ldap auth
2. Login with ldap User in satellite and logout
3. create usergroup and assign ldap user to it
4. perform upgrade
5. After upgrade ldap user was not part of user group

Tested with upgrade from 6.5 to 6.6 snap 22, ldap user user group membership not lost after upgrade.
Comment 7 Nikhil Kathole 2019-09-26 11:39:51 UTC 
Created attachment 1619479 [details]
After upgrade - screenshot
Comment 8 Bryan Kearney 2019-10-22 19:48:01 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3172