Bug 2208588

Summary:	Unable to access Satellite 6 API using non-admin users.
Product:	Red Hat Satellite	Reporter:	Akshay Kapse <akapse>
Component:	Users & Roles	Assignee:	Adam Ruzicka <aruzicka>
Status:	POST ---	QA Contact:	Lukáš Hellebrandt <lhellebr>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.12.4	CC:	aruzicka, lhellebr, mhulan, oezr
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Akshay Kapse 2023-05-19 16:45:31 UTC

Unable to access Satellite 6 API using non-admin users.

Description of problem:

Non-Admin Users cannot access API, no matter which roles has been assigned to them.

The same user will be able to access, when you mark the user as "ADMIN".

Tested on Satellite 6.11, 6.12, 6.13

Version-Release number of selected component (if applicable):

How reproducible:
100 %

Steps to Reproduce:
1. Create a user "NA-USER" on Satellite GUI but don't mark it as Admin.

2. Assign all the Roles to the user "NA-USER" but don't mark it as "Admin" and then try accessing the API:

3. Try to access the API https://satellite.example.com/api/v2/



Actual results:
~~~
error	
message	"Access denied"
details	"Missing one of the required permissions: "
missing_permissions	[]
~~~


Expected results:
Should have some role which can allow non-admin users to access api.


Additional info:
If I mark the same user as Admin, it will be able to access the API successfully and will be able to see the result as well.

Similar bug which got resolved on Satellite version 6.8: https://bugzilla.redhat.com/show_bug.cgi?id=1757394

Upstream Foreman Issue Tracker for Satelltie 6.8: https://projects.theforeman.org/issues/28405

Comment 1 Adam Ruzicka 2023-05-19 16:57:36 UTC

What do you expect to get from that particular endpoint?

Comment 2 Akshay Kapse 2023-05-19 17:08:28 UTC

Hello,

If we check non-admin user as "Administrator" it shows API details.
Can we have some role for that so that non-admin user can get idea about API calls while using them?


Thanks,

Comment 4 Adam Ruzicka 2023-05-29 15:28:19 UTC

Created redmine issue https://projects.theforeman.org/issues/36449 from this bug

Comment 5 Bryan Kearney 2023-06-08 16:03:58 UTC

Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/36449 has been resolved.