Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1061203

Summary: Installer overwrites existing users without any notification
Product: [Retired] JBoss BRMS Platform 6 Reporter: Tomas Livora <tlivora>
Component: InstallerAssignee: Miles Tjandrawidjaja <mtjandra>
Status: CLOSED CURRENTRELEASE QA Contact: Tomas Livora <tlivora>
Severity: medium Docs Contact:
Priority: high    
Version: 6.0.0CC: apodhrad, jcoleman, kverlaen, mtjandra, rrajasek, rzhang, thauser
Target Milestone: ER2   
Target Release: 6.0.1   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-08-06 19:57:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Overwrite users?
none
Error when overwriting. none

Description Tomas Livora 2014-02-04 14:47:07 UTC
Description of problem:
When you install BPMS/BRMS into an existing EAP where some users have already been created and try to create the same users with installer, the existing user roles and passwords are overwritten without any notification.

Version-Release number of selected component (if applicable):
6.0.0 CR2

Steps to Reproduce:
1. Download and unzip pure EAP.
2. Create new management and application users.
3. Check user roles and hashed passwords in the properties files.
4. Run the installer and try to create the same users as before.

Actual results:
If you have a look at the properties files you will notice that passwords and user roles have been changed without any notification.

Expected results:
Notify about the conflict and ask if the existing user configuration should be overwritten.

Comment 1 Thomas Hauser 2014-02-13 21:54:42 UTC
Reproduced.

Comment 2 Thomas Hauser 2014-02-14 21:27:10 UTC
After aligning the brms/bpms installer with fsw/sramp/dv installers, we now have a warning about possible overwriting of users. See attached screenshot.

Comment 3 Thomas Hauser 2014-02-14 21:27:51 UTC
Created attachment 863433 [details]
Overwrite users?

Comment 4 Thomas Hauser 2014-02-14 21:29:43 UTC
This warning only occurs for the EAP admin user. Perhaps we should extend this functionality to include application users as well?

Comment 5 Tomas Livora 2014-02-17 10:17:02 UTC
Thomas, your screenshot is only showing the screen where you can choose if you want to create a new user or skip this step. What I meant was a warning that should appear when you actually try to create a new user (EAP or application) with the username that already exists.

Comment 6 Julian Coleman 2014-02-18 10:46:27 UTC
We probably shouldn't support installing into EAP when any configuration has been applied.
However, detecting that EAP has been altered would be a lot of extra work (if possible for all changes).

Comment 7 Thomas Hauser 2014-02-21 15:44:21 UTC
This issue is not fully fixed in ER1. The overwrite warning will appear if the user attempts to add a duplicate ManagementRealm user, but not for Application users. ER2 fixes the second sub-problem.

Comment 8 Andrej Podhradsky 2014-02-27 08:24:55 UTC
Status changed to ASSIGNED since this is not fully fixed (see comment#7)

Comment 9 Miles Tjandrawidjaja 2014-03-03 17:09:41 UTC
Created attachment 870052 [details]
Error when overwriting.

Changes have been implemented to ensure no user gets overwritten, including application users.
The user will be informed that you are unable to overwrite the existing user.

Comment 10 Tomas Livora 2014-03-04 07:58:09 UTC
Miles, it looks good. But would it not be better to unify the dialogs and in this case use the same one as is shown when try to overwrite EAP user? Because according to the attachment you actually cannot overwrite existing users. It is just a recommendation. If it means a lot of extra work then the current solution should be sufficient.

Comment 11 Thomas Hauser 2014-03-04 15:33:23 UTC
Tomas,

It is actually possible to overwrite the admin user, but not the other users. We made this decision because it allows for better support for layering, and ensures functionality of the product being installed / products already installed.

Suppose the user installed FSW, and then wants to install BRMS over top of it. By chance, they name the BRMS user the same as the FSW admin user. If we allow overwriting in this case, FSW will become unusable, at least until the user manually recreates a user and vaults the password etc. I think that simply disallowing overwriting is better in this case, but we could change it such that the same dialog and options are offered (overwrite, skip, cancel). The work involved for that is not extensive.

Comment 12 Tomas Livora 2014-03-04 16:16:07 UTC
Thomas, that is a good point! I did not think about it this way. It should probably not be allowed to overwrite existing users from other applications.

Comment 13 Tomas Livora 2014-03-05 12:40:38 UTC
Verified on BPMS 6.0.1 ER2