Bug 2143051

Summary:	edit_organization permissions needed on upstream satellite
Product:	Red Hat Satellite	Reporter:	Calvin Smith <casmith>
Component:	Inter Satellite Sync	Assignee:	Partha Aji <paji>
Status:	CLOSED ERRATA	QA Contact:	Sam Bible <sbible>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.11.4	CC:	ahumbe, paji, rlavi, sbible
Target Milestone:	6.14.0	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-11-08 14:18:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Calvin Smith 2022-11-15 22:13:56 UTC

Description of problem:
The documentation around ISS says that the downstream satellite's credentials needs edit_organization permissions to download the certificate

Version-Release number of selected component (if applicable):
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_disconnected_network_environment/index#configuring-server-to-synchronize-content-over-a-network_satellite

How reproducible:
Every time

Why is this OK and is there a workaround for customers that do not want to give downstream owners edit_organization permissions

Comment 1 Brad Buckingham 2022-12-08 13:54:15 UTC

Hi Partha,

Do you happen to know why downloading the CA certificate requires the edit_organization permission? (See referenced doc link)

Does it provide more than the ability to retrieve/view content?

Thanks!

Comment 2 Partha Aji 2023-04-06 19:36:40 UTC

There are 2 parts to the access here
1) To access the apache instance on the upstream you need the contents of https://<upstream-fqdn>/pub/katello-server-ca.crt
2) To access the RH repo contents itself you need the upstream organization's debug certificate. 

I  tested this and it seems odd but I really needed edit organization to download an organizations Debug Certificate (my guess is because it needs to be able to create a debug certificate if its not already there.) Will try to fix this.

Comment 3 Partha Aji 2023-06-13 04:30:27 UTC

Connecting redmine issue https://projects.theforeman.org/issues/36503 from this bug

Comment 4 Bryan Kearney 2023-06-13 08:02:36 UTC

Upstream bug assigned to paji

Comment 5 Bryan Kearney 2023-06-13 08:02:38 UTC

Upstream bug assigned to paji

Comment 6 Bryan Kearney 2023-06-15 16:02:32 UTC

Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/36503 has been resolved.

Comment 9 Sam Bible 2023-10-03 17:23:02 UTC

Verified on: 6.14 - Snap 18

Steps to Verify:
1. Create 2 Satellites, one downstream and one upstream
2. Create a role on the upstream satellite, with the following permissions:
   view_organizations
   view_products
   view_lifecycle_environments
   view_content_views
   export_content
3. Follow the instructions for Network Content Sync here:https://docs.theforeman.org/nightly/Managing_Content/index-katello.html#configuring-server-to-synchronize-content-over-a-network_content-management
4. Attempt to enable a few different repos on the downstream satellite.

Expected Results:
You are able to successfully setup Network CDN, and successfully enable the repositories synced on the upstream Satellite.

Actual Results:
You are able to successfully setup Network CDN, and successfully enable the repositories synced on the upstream Satellite.

Comment 12 errata-xmlrpc 2023-11-08 14:18:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.14 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:6818