Bug 923197

(In reply to comment #0)
> Description of problem:
> User don't have access to /domain/domain_id/users url.
> 
> Version-Release number of selected component (if applicable):
> sf10
> 
> How reproducible:
> always
> 
> Steps to Reproduce:
> 1. Add UserVmManager permissions on cluster to user1.
> 2. As user1 access url /domain/domain_id/users url (filter=True)
>   
> Actual results:
> <fault>
> <reason>Operation Failed</reason>
> <detail>
> query execution failed due to insufficient permissions.
> </detail>
> </fault>
> 
> Expected results:
> User can see all users in domain, or only users which are already added to
> system?
> 

why do you think user should be able to see all other users in the system?

(In reply to comment #1)
> why do you think user should be able to see all other users in the system?

If user has manipulate_permission action group, he also should view users when he want to add them permissions.

(In reply to comment #2)
> (In reply to comment #1)
> > why do you think user should be able to see all other users in the system?
> 
> If user has manipulate_permission action group, he also should view users
> when he want to add them permissions.

view users true, but existent users in /api/users, but not domain users
in /domain/domain_id/users as manipulate_permission not equal to add_users, 
i.e manipulate_permission means changing permissions for existent users in the
system

Well in UserPortal user can see all users in other domains but it is buggy( bug 923191 ) - so yes, maybe user should not see all other users in domains, but it should be removed also from UserPortal.

User also can't see all added users in /api/users, if user access to /api/users/ response is only one user itself. But he can see all added users in system, accessing them directly via id like: /api/users/$user_id. So if user should see all added users(except admin users?) under /api/users - i will open new bz for it.

Similar bug is bug 923100. It talked about the UI.
There, we currently show all users, and allow you to add permissions to a user even if it isn't added as an oVirt user.

I think that through the API, we should only allow "users" to see the existent users, and not all the domain users. 

I think that it should be done in the UI as well in the future (I guess it is a bigger fix). Maybe only in the user portal, as in the admin portal we would probably want to make it easier, allowing to add a user and grant him different permissions, in the same time.

Yair - what are your thoughts about that?

per comment #5 looks like the behaviour should be fixed in the user portal.

Simon ?

(In reply to comment #5)
> Similar bug is bug 923100. It talked about the UI.
> There, we currently show all users, and allow you to add permissions to a
> user even if it isn't added as an oVirt user.
> 
> I think that through the API, we should only allow "users" to see the
> existent users, and not all the domain users. 
> 
> I think that it should be done in the UI as well in the future (I guess it
> is a bigger fix). Maybe only in the user portal, as in the admin portal we
> would probably want to make it easier, allowing to add a user and grant him
> different permissions, in the same time.
> 
> Yair - what are your thoughts about that?

Oved - sounds reasonable to me, I don't see any reason why at User portal we should see all domain users, and not just the ones that were added by the webadmin.

User in userportal can now see only users which were added to system,
he can't see users from domain, which was not added. Verified is12.

*** Bug 923191 has been marked as a duplicate of this bug. ***

Closing - RHEV 3.3 Released

Closing - RHEV 3.3 Released