Bug 577791

Summary:	LDAP: Appropriate role to existing user in rhq is not assigned against which the ldap group is mapped.
Product:	[Other] RHQ Project	Reporter:	Sunil Kondkar <skondkar>
Component:	Configuration	Assignee:	Sunil Kondkar <skondkar>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Corey Welton <cwelton>
Severity:	low	Docs Contact:
Priority:	low
Version:	3.0.0
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	2.4	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-08-12 16:45:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	577267

Description Sunil Kondkar 2010-03-29 09:05:34 UTC

Description of problem:
Appropriate role to existing user in rhq is not assigned against which the ldap group is mapped.

Version-Release number of selected component (if applicable):

3.0.0-SNAPSHOT

How reproducible:


Steps to Reproduce:

1. Login to RHQ as rhqadmin and create a user without assigning a role. (Ex: sameuser)

2. Create a similar user in ldap as in #1. (Ex: sameuser)

3. Add the user to an already existing ldap group (which is mapped to a certain role in RHQ. Ex: All resources role)
 
4. Login to RHQ as the user created in #1.(Ex: sameuser)

5. Check if the appropriate role is assigned against which the ldap group is mapped.
  
Actual results:

The user is able to login to rhq but he is not assigned the role against which the ldap group is mapped.

Expected results:

User should be able to login and the appropriate role should be assigned against which the ldap group is mapped.

Additional info:

Comment 1 Charles Crouch 2010-04-05 15:43:08 UTC

Mapping RHQ users (created in step1) to LDAP users (created in step 2) is not supported.

If you create a user in RHQ then you manage its roles through RHQ.
If you create a user in LDAP then you manage its groups in LDAP and the role/group mapping in RHQ.

In your case if you were to delete the RHQ user created in step1, then we should attempt to authenticate and authorize against ldap and everything should work as expected

Comment 2 Charles Crouch 2010-04-05 15:44:12 UTC

Please retest by removing the RHQ database user and checking the ldap user is logged in as appropriate

Comment 3 Sunil Kondkar 2010-04-06 12:33:20 UTC

Verified against the master build#153. 

Removed the user from RHQ users list and logged in as the same user in rhq.
Observed that user is assigned the appropriate role against which the ldap group is mapped.

Please suggest if this test case (mapping existing rhq users to ldap users) could be considered as an enhancement in future?

Comment 4 Corey Welton 2010-08-12 16:45:11 UTC

Mass-closure of verified bugs against JON.