Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Created attachment 1002206[details]
provision dropdown active when "discover_reader" role assigned to normal user
Description of problem:
Created a user and assigned "discovery Reader" role to it. When login with created user, I can see the discovered host. But I can also click on "provision dropdown". All values under dropdown are active.
Similarly when you click on 'discovered host' name, you will see facts page. On facts page too, "delete" and "Select action" dropdown are active.
These needs to be disabled though UI throws 403 permission denied error on clicking any of them. But this looks misleading. we should disable the buttons.
Version-Release number of selected component (if applicable):
sat6.1 beta snap6 compose2 (Satellite-6.1.0-RHEL-6-20150311.1).
How reproducible:
always
Steps to Reproduce:
0. login with admin user
1. discover a host
2. define a discovery rule
3. create a new user and assign "Discovery Reader" role
4. logout
5. login with new user
6. go to hosts --> discovered host
Actual results:
on discovered_host page, I can also click on "provision dropdown". All values under dropdown are active.
Also, when you click on 'discovered host' name, you will see facts page. On facts page too, "delete" and "Select action" dropdown are active.
Expected results:
"provision dropdown" on discovered host page needs to be disabled.
"delete" and "Select action" dropdown on facts page needs to be disabled.
Additional info:
Ori, another permission-related. Please create appropriate upstream issues, link them and it looks like we need to review permissions for 2.0.1 discovery release (3.0.0 as well).
Verified with sat6 beta snap6.2
The bz description contains issues at two places:
1) "provision dropdown" on discovered_host page
2) "delete" and "Select action" dropdown on facts page
I can see see 'delete' and 'select action' dropdown on facts page with a normal user who has 'discovery_reader' role assigned.
Sachin, I can only see the dropdown on the Discovered Host detail page: Select action -> Provision...Reboot.
I don't see others in the code, can you provide screenshots of what you found?
Merged upstream as https://github.com/theforeman/foreman_discovery/pull/266/files
Please try to apply the patch and if it fails (which I assume) simply move this bug to 6.3. This is not worth the effort in backporting, there have been big refactoring in upstream in the meantime.
Created attachment 1002206 [details] provision dropdown active when "discover_reader" role assigned to normal user Description of problem: Created a user and assigned "discovery Reader" role to it. When login with created user, I can see the discovered host. But I can also click on "provision dropdown". All values under dropdown are active. Similarly when you click on 'discovered host' name, you will see facts page. On facts page too, "delete" and "Select action" dropdown are active. These needs to be disabled though UI throws 403 permission denied error on clicking any of them. But this looks misleading. we should disable the buttons. Version-Release number of selected component (if applicable): sat6.1 beta snap6 compose2 (Satellite-6.1.0-RHEL-6-20150311.1). How reproducible: always Steps to Reproduce: 0. login with admin user 1. discover a host 2. define a discovery rule 3. create a new user and assign "Discovery Reader" role 4. logout 5. login with new user 6. go to hosts --> discovered host Actual results: on discovered_host page, I can also click on "provision dropdown". All values under dropdown are active. Also, when you click on 'discovered host' name, you will see facts page. On facts page too, "delete" and "Select action" dropdown are active. Expected results: "provision dropdown" on discovered host page needs to be disabled. "delete" and "Select action" dropdown on facts page needs to be disabled. Additional info: