Red Hat Bugzilla – Bug 1113950
Docs say admin roles doesn't confer to user portal
Last modified: 2016-01-26 20:59:22 EST
Description of problem: User abc: Rights on UserPortal: UserRole Rights on AdminPortal: SuperUser An admin creates a VM and grant UserRole permissions for a specific group. If user abc logs into UserPortal he can delete the VM but in UserRole it is explicitly forbidden. See documentation: RHEV 3.4 Administration Guide - 16.4.2. User and Administrator Roles Thank you! Regards, Florian Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
In order to investigate this bug we need to understand better what permissions does the user have, and on which objects. In general, when working with the user portal, your user roles determine what you can see, but with regards to what you can do, your admin roles are also being considered. So, if you can see the VM, and you have permissions to delete it (wither via user or admin role), then you'll be able to delete it.
user portal permissions change what users can see. it doesn't change the actions they can do. (only queries are using the user portal moniker for filtering. actions do not)
(In reply to Itamar Heim from comment #2) > user portal permissions change what users can see. it doesn't change the > actions they can do. > (only queries are using the user portal moniker for filtering. actions do > not) So in that case the bug can be closed... assuming that's indeed the issue. Florian - is that indeed the issue you're seeing?
Hello! Thank you for the fast response. Referring to the documentation mentioned above: If user abc has the standard UserRole in UserPortal (and has no permission to delete a VM!) so he can't delete the VM (-> no problem). But if the user abc has additionally SuperUser rights in AdminPortal, (documentation says that a Administrator Portal Role(SuperUser) has no impact referring to UserPortal) and login to UserPortal so he can delete the VM but as PortalUser he hasn't the permission to delete the VM. So what's wrong there? Perhaps the documentation? excerpt of documentation: 16.4.2. User and Administrator Roles Red Hat Enterprise Virtualization provides a range of pre-configured roles, from an administrator with system-wide permissions to an end user with access to a single virtual machine. While you cannot change or remove the default roles, you can clone and customize them, or create new roles according to your requirements. There are two types of roles: Administrator Role: Allows access to the Administration Portal for managing physical and virtual resources. An administrator role does not confer any permissions for the User Portal. User Role: Allows access to the User Portal for managing and accessing virtual machines and templates. A user role does not confer any permissions for the Administration Portal. For example, if you have an administrator role on a cluster, you can manage all virtual machines in the cluster using the Administration Portal. However, you cannot access any of these virtual machines in the User Portal; this requires a user role. Regards, Florian
Indeed a documentation issue. Moving to proper product/component. Thanks for bringing this up.
The right documentation should be that the user roles do confer to the user portal, with regards to actions the user can do. However, they have no effect to what the user can see in the user portal
Descriptions of administrator role and user role have been updated in "User and Administrator Roles" (topic 7923) to reflect the actual permissions each role grants in the User Portal (as discussed in this bug).
Documentation Link ------------------------------ https://documentation-devel.engineering.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.5-Beta/html-single/Administration_Guide/index.html#User_properties_roles What Changed ------------------------------ The following topic was revised to correct the description of permissions granted by user and administrator roles, as outlined in the bug above (specifically Comment #4 and Comment #6) User and Administrator Roles [7923-681821] Updated revision history: [34613-687013] NVR ------------------------------ Red_Hat_Enterprise_Virtualization-Administration_Guide-3.5-Beta-web-en-US-3.5-5.el6eng Moving to ON_QA.