Bug 1984471

Summary:	Enable token-based authorization for inventory access
Product:	Migration Toolkit for Virtualization	Reporter:	Jeff Ortel <jortel>
Component:	Inventory	Assignee:	Jeff Ortel <jortel>
Status:	CLOSED ERRATA	QA Contact:	Amos Mastbaum <amastbau>
Severity:	unspecified	Docs Contact:	Avital Pinnick <apinnick>
Priority:	unspecified
Version:	2.1.0	CC:	istein, mturley
Target Milestone:	---
Target Release:	2.1.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-08-26 07:09:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jeff Ortel 2021-07-21 14:09:53 UTC

Enable OCP token based authorization to restrict access to the inventory to only those OCP users with "*" access to the associated Provider CR.

Authorization was implemented in the inventory in 2.0 but not enabled (disabled by default).  In 2.0, the UI started passing the token header.  This should just involve a (1) change in the controller to default the setting and test with the UI.

Comment 1 Mike Turley 2021-08-05 17:42:10 UTC

Found that the UI requires a change to pass the correct token header. PR incoming.

Comment 2 Ilanit Stein 2021-08-09 16:09:28 UTC

How to verify: 

The primary goal is to ensure that inventory data is limited to caller that is authenticated 
by the Openshift cluster.

MTV currently does not support non-admin use cases,
therefore it will be tested only by a getting on rest-api endpoints result in
401 (Unauthorized) when no token is included in the request.
403 (Forbidden) when the token is invalid.

Comment 3 Amos Mastbaum 2021-08-11 07:32:19 UTC

mtv 2.1.0-44
verified 401/403 + UI Sanity

Comment 6 errata-xmlrpc 2021-08-26 07:09:27 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Migration Toolkit for Virtualization 2.1.0), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2021:3278