Bug 1866229
| Summary: | Impersonate normal user doesn't hide menus requiring cluster admin permission | ||||||
|---|---|---|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Yanping Zhang <yanpzhan> | ||||
| Component: | Management Console | Assignee: | Rastislav Wagner <rawagner> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Yadan Pei <yapei> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 4.6 | CC: | aos-bugs, cajieh, jokerman, nmukherj, spadgett | ||||
| Target Milestone: | --- | Keywords: | Regression | ||||
| Target Release: | 4.6.0 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | No Doc Update | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2020-10-27 16:24:53 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
I think the change in the API implementation from REST to GraphQL caused this bug. The GraphQL `SelfSubjectAccessReview` endpoint is returning property `allowed:true` for user impersonation action. This should be `allowed: false` based on my finding from the previous REST API implementation. The GraphQL code changed - https://github.com/openshift/console/commit/305ca9b3769ac9dfbac2897d4a3e547cf9aaab86#diff-e68ced0804dcc8510c62688ad6f13191R221 Based on info from the https://bugzilla.redhat.com/show_bug.cgi?id=1866229#c1 assigning the issue to Rastislav since he was working on the implementation. Checked on ocp 4.6 cluster with payload 4.6.0-0.nightly-2020-08-20-174655. Now impersonate user will show correct menus for normal user, cluster admin menus will be hidden. The bug is fixed. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4196 |
Created attachment 1710473 [details] menus Description of problem: Cluster admin login console, on the user list page, impersonate a normal user, check left menus, those menus requiring cluster admin role are not hidden to normal user. Version-Release number of selected component (if applicable): 4.6.0-0.nightly-2020-08-03-143208 How reproducible: Always Steps to Reproduce: 1.Cluster admin login console, on user list page, impersonate a normal user, check left menus 2. 3. Actual results: 1. Menus like "Compute", "Administration" are not hidden for normal user. Expected results: 2. Should hidden those menus which normal user have no right to access. Additional info: