Bug 577828

Summary:	LDAP: ldap user should be given the least privileges of the two roles to which he belongs.
Product:	[Other] RHQ Project	Reporter:	Sunil Kondkar <skondkar>
Component:	Configuration	Assignee:	Sunil Kondkar <skondkar>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Corey Welton <cwelton>
Severity:	medium	Docs Contact:
Priority:	low
Version:	3.0.0
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	2.4	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-08-12 16:52:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	577267

Description Sunil Kondkar 2010-03-29 11:52:00 UTC

Description of problem:

LDAP: ldap user should be given the least privileges of the two roles to which he belongs.

Version-Release number of selected component (if applicable):

3.0.0-SNAPSHOT

How reproducible:


Steps to Reproduce:

1. Make ldap user (Ex: user3) member of two different groups say 'Test1' and 'Test2' in ldap.
2. The two different groups are mapped to two different roles in rhq. 
( Group 'Test1' is mapped to role 'All Resources' and group 'Test2' is mapped to a role say 'Role2' having least privileges.
3. Login as ldap user (Ex: user3) into rhq.
4. Check the user role privileges after login.

  
Actual results:

User is not given least privileges of the two roles to which he belongs. ( User is given privileges of role 'All Resources')

Expected results:

User should be given the least privileges of the two roles to which he belongs. (Should be given 'Role2' privileges)

Additional info:

Comment 1 Charles Crouch 2010-04-05 16:02:20 UTC

I think we should carry on with the same behaviour as we have currently in RHQ. This can be tested without using LDAP at all, just assign a user to two RHQ roles and see which privileges they get. I think it will probably end up with the superset of privileges, which has proved fine thus far.

Comment 2 Sunil Kondkar 2010-04-06 12:11:16 UTC

Verified as suggested in rhq against the maser build#153.
If a user is assigned two different roles having different privileges in rhq, he gets the higher privileges of two roles.

Comment 3 Corey Welton 2010-08-12 16:52:25 UTC

Mass-closure of verified bugs against JON.