Users assigned to multiple roles would see operations in the console that they did not have access to perform. For example, a user with roles *host-master-administrator* and *host-slave-monitor* should only have been able to see control elements (such as the *Add* button on the server configurations page) in context of host slave. This button should not have been visible when operating in context of host master (however it was).
Operations that were incorrectly visible would fail if attempted, as the correct access control was enforced in the execution of the operation. There was no security violation.
This issue in the management console has been fixed in this release. Control elements which are not relevant for a user role, while visible, are 'grayed-out' and are not active.
Control elements are visible whenever it is required by one of user's roles regarding current host / group Context. Lets say we have user with roles "host-master-administrator" and "host-slave-monitor". This user should be able to see control elements (such as "Add" button on server configurations page) only in context of host slave, when operating in context of host master this button should not be visible.
For server groups things are more complicated as all groups are listed on one page. Thus making buttons enabled / disabled based on selected resource might be a better solution
So the user experience would be that the button is visible in a context when it should not be, but the operation will fail if the user attempts it?
If we cannot resolve this issue with our current timeline, we should defer.
Added text for a known issue.
It's a known issue, that has already been postponed. See above.
Acknowledged. I already added text for the release note.
The original report, and in consequence also the Doc Text, is wrong in one detail: the control elements should only be visible in context of host _master_ (as for this host, the user is in the administrator role). Jakub, please confirm.
That's true, I've accidentally switched the context in my description.
Russell, can you correct the Doc Text please?
Modified Doc Text content (appears to gel with Jakub's comment 12) and marked for inclusion in 6.2 Release Notes document.
Part of this is done by https://github.com/jbossas/jboss-eap/pull/1024
Harald Pehl <firstname.lastname@example.org> updated the status of jira HAL-238 to Resolved
Edited release note as per bug 1097786.