Bug 997046

Summary:	[RFE] AD / LDAP Integration
Product:	Red Hat Satellite	Reporter:	Xabier Guitián <xabiergd>
Component:	Content Management	Assignee:	Katello Bug Bin <katello-bugs>
Status:	CLOSED UPSTREAM	QA Contact:	Katello QA List <katello-qa-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	Nightly	CC:	bkearney, cwelton, mmccune, omaciel, xabiergd
Target Milestone:	Unspecified	Keywords:	FutureFeature, Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-07-17 18:36:57 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Xabier Guitián 2013-08-14 14:42:33 UTC

Description of problem: Right now when AD is the backend for user info, if the user exists on AD katello auto-creates the account with no privileges. This should be an option, not the default, or you could end up with a lot of accounts on katello with no roles at all.


Version-Release number of selected component (if applicable):
MDP1

How reproducible: Easily.

Steps to Reproduce:
1. Configure katello to use an AD as backend.
2. Login with an AD user on katello, you should login fine.
3. Access with an admin and see that the user from AD has no permissions at all.

Actual results: You can end up with a lot of undesired users.


Expected results: You should not been able to log on.


Additional info: You should be able to restrict access to katello in different ways:
  * Just local accounts
  * Just AD accounts already created on katello
  * Users from AD belonging to some group (ldap filter memberOf)

And if you permit the account to be auto-created, you should be able to define which permissions it will have.

Thanks,

Comment 1 Og Maciel 2013-08-14 14:59:02 UTC

I agree with you here. A possible way to improve this a bit would be to document the process of user creation when using AD so that the admin user *must* specify a  role as part of the process? Another option: You can either associate an existing role (or create a new one) to a AD group and new AD users who are part of said group would automatically get that role/permissions.

Comment 2 Xabier Guitián 2013-08-16 07:46:34 UTC

That would be a nice option too. So if the user does not belong to some role on the Satellite, it would not be able to log on. Whatever the method used, the user needs to belong to some role.

Comment 3 RHEL Program Management 2013-09-17 04:18:40 UTC

Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 6 Bryan Kearney 2014-06-18 01:07:16 UTC

This feature is delivered with Satellite 6. Per discussions with the dev lead, a nice to have feature would be https://bugzilla.redhat.com/show_bug.cgi?id=1110557. I am moving this to ON_QA since the feature has been delivered, and the other bug can be triaged to a future release.