Bug 2075195

Summary:	[RFE] Add warning message \| Users not belonging to mapped group keep looping when logging in via Horizon
Product:	Red Hat OpenStack	Reporter:	Cristian Muresanu <cmuresan>
Component:	python-django-horizon	Assignee:	Radomir Dopieralski <rdopiera>
Status:	ASSIGNED ---	QA Contact:	Ashish Gupta <ashigupt>
Severity:	medium	Docs Contact:
Priority:	low
Version:	16.1 (Train)	CC:	cmuresan, rdopiera
Target Milestone:	ga	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Cristian Muresanu 2022-04-13 19:13:10 UTC

Description of problem:

When a user tries to login via the horizon dashboard with SSO, they keep getting redirected back to the login page without any message indicating a reason if their group mapping is not setup in the overcloud, i.e., they are not part of any remote group that's currently mapped.

This leads to the false assumption that the system is broken when it is not. I've looked through the keystone and horizon logs for signs of errors/warnings or even looping behavior but wasn't able to notice much. We have tested this behavior with more than one user with consistent results.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:
Have the federated users that are not part of the group mapping be given an error message (any error message) rather than keep looping back to the login screen without any hint as to why their access is not working.

Additional info:

Comment 1 Cristian Muresanu 2022-04-13 19:14:12 UTC

Found this on the documentation[1] where is mentioned the following:
~~~
During the federated authentication process, members of the IdM group openstack-users are mapped into the OpenStack group federated_users. As a result, an IdM user will need to be a member of the openstack-users group in order to access OpenStack; if the user is not a member of the IdM group openstack-users, then authentication will fail.
~~~

[1] http://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16.0/html-single/federate_with_identity_service/index#operational-goals