Bug 1845498
Summary: | 50/50 chance to create role filter with non-admin user and enough permissions | ||
---|---|---|---|
Product: | Red Hat Satellite | Reporter: | Rafael Cardoso <rdesouza> |
Component: | Users & Roles | Assignee: | Ondřej Ezr <oezr> |
Status: | CLOSED ERRATA | QA Contact: | Peter Ondrejka <pondrejk> |
Severity: | low | Docs Contact: | |
Priority: | unspecified | ||
Version: | 6.6.0 | CC: | apatel, jjansky, kgaikwad, ktordeur, mhulan, ofedoren, osousa, rabajaj, satellite6-bugs |
Target Milestone: | 6.10.0 | Keywords: | Triaged |
Target Release: | Unused | ||
Hardware: | x86_64 | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | foreman-2.5.1 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2021-11-16 14:09:12 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Rafael Cardoso
2020-06-09 12:01:04 UTC
Hi Rafael, I wasn't able to reproduce this, could you please provide hammer logs and development logs? Created redmine issue https://projects.theforeman.org/issues/30394 from this bug Upstream bug assigned to oezr Upstream bug assigned to oezr Hi, I've pinpointed the issue to a bug, that we consider Locations and Organizations assigned to filters as 'Belongs to', but this assignment means 'Applies to'. This causes Role with permissions to manage Filters to be able to manage only Filters that have the same Locations and Organizations as this Role (specificaly as the Filter on Filter resource). This is wrong and permissions to manage filters should apply globally as it is a global resource and some filters don't have Locations and Organizations (e.g. Miscallenous). My upstream patch is removing the ability to chose what Orgs/Locs the permissions to manage filters apply to thus Role with such permissions will be allowed to manage all Filters in Satellite. This will probably land in 6.10, so until then I have a workaround. To achive this without the patch (before 6.10) you need to navigate to the Role that allows managing Filters, edit the Filter on resource Filter, check `override` checkbox and deselect all the Organizations and Locations in the tabs that appear. After saving, this Role will be able to manage all the filters in Satellite as with the patch and thus it will always succeed to create Filter. Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/30394 has been resolved. Verified on Satellite 6.10 sn 8 using steps from problem description and comment 1. Non admin user with relevant permissions can now create roles with 100% success rate. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4702 |