Bug 923191
| Summary: | [UserPortal] User can see other users only from one domain, selected domain is ignored. | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Virtualization Manager | Reporter: | Ondra Machacek <omachace> | ||||
| Component: | ovirt-engine | Assignee: | Ravi Nori <rnori> | ||||
| Status: | CLOSED DUPLICATE | QA Contact: | Ondra Machacek <omachace> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 3.2.0 | CC: | acathrow, bazulay, ecohen, emesika, iheim, jkt, lpeer, movciari, pstehlik, Rhev-m-bugs, yeylon, yzaslavs | ||||
| Target Milestone: | --- | ||||||
| Target Release: | 3.4.0 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | infra | ||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2014-01-08 21:10:31 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | Infra | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1078909, 1142926 | ||||||
| Attachments: |
|
||||||
|
Description
Ondra Machacek
2013-03-19 11:56:01 UTC
Ondra, Is the domain the user can search limited to the domain the user belongs to or is it an arbitrary domain? If the user is limited only to domain he belongs to, then it should not be a bug since not sure the user should have permissions to see users from other domains it may be a security issue. (In reply to comment #1) > Ondra, > > Is the domain the user can search limited to the domain the user belongs to > or is it an arbitrary domain? Seems, that are shown users from last domain in alphabet. This happens only in user portal. Does not happen in admin portal. *** Bug 972751 has been marked as a duplicate of this bug. *** At UserPortal we use two user queries - AdUserSearch and AdGroupSearch. At Webadmin we call two queries of SearchQuery and pass pass each time different search type - Group or User. Seems like the search patterns are different - For user portal (looking for a*) groups: ADGROUP: name=a* users: ADUSER: allnames=a* For admin portal: (looking for a* at domain example.com) users: ADUSER: allnames=a* groups: ADGROUP: name=* Since there is no domain in case of user portal, the getDefaultDomain() (at the SearchQuery class) method is invoked which returns the default name which gets the first domain from the domains list that is defined in vdc_options (DomainName entry). Simon, if a user can add permissions via user portal, is it ok that he will add permissions from multiple domains? if so, we just need to fix the AdUserSearch and AdGroupSearch queries (In reply to Yair Zaslavsky from comment #5) > > Simon, if a user can add permissions via user portal, is it ok that he will > add permissions from multiple domains? if so, we just need to fix the > AdUserSearch and AdGroupSearch queries Look at #comment 1 (In reply to Simon Grinberg from comment #6) > (In reply to Yair Zaslavsky from comment #5) > > > > Simon, if a user can add permissions via user portal, is it ok that he will > > add permissions from multiple domains? if so, we just need to fix the > > AdUserSearch and AdGroupSearch queries > > Look at #comment 1 Ok, then what we should do is not use getDefaultDomain, but getCurrentDomain (from the user on the session). So to summarize the above discussion, this is what I am going to do: 1.) In UserPortal's add permissions dialog - remove other domains from selection, the user should only see users from his own domain. 2.) Make sure the users he can actually see after searching are those from his own domain, and not some other randomly selected domain. makes sense? (In reply to Mooli Tayer from comment #8) > So to summarize the above discussion, > this is what I am going to do: > > 1.) In UserPortal's add permissions dialog - remove other domains from > selection, the user should only see users from his own domain. > > 2.) Make sure the users he can actually see after searching are those from > his own domain, and not some other randomly selected domain. > > makes sense? Yes. Also make sure that the user have the permission to manipulate users in the first place. Long term we may need to add domains as an entity we can set permissions on. Then admin can grant a user with permission to assign permission to users from this domain. *** This bug has been marked as a duplicate of bug 923197 *** |