Bug 1313904 - When an AD group is assigned superuser access to a cluster, users in that group are not given access to the VMs in that cluster
When an AD group is assigned superuser access to a cluster, users in that gro...
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Virtualization Manager
Classification: Red Hat
Component: ovirt-engine (Show other bugs)
3.5.7
All Linux
high Severity high
: ovirt-4.0.4
: ---
Assigned To: Arik
:
Depends On:
Blocks: 1320343
  Show dependency treegraph
 
Reported: 2016-03-02 10:15 EST by Allan Voss
Modified: 2016-08-15 02:52 EDT (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-08-15 02:52:25 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: Virt
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Allan Voss 2016-03-02 10:15:51 EST
Description of problem:
When an AD group is assigned superuser access to a cluster, users in that group are not given access to the VMs in that cluster

Version-Release number of selected component (if applicable):
rhevm-3.5.7-0.1

How reproducible:
very

Steps to Reproduce:
1. Assign a group 'superuser' role on a cluster
2. log in as member of that group
3. attempt to access VM in that cluster

Actual results:
User not given access to that VM

Expected results:
User should have access to the VM as per the cluster settings
Comment 1 Oved Ourfali 2016-03-03 01:24:05 EST
Can you elaborate what do you mean by access to VM?
Comment 3 Tomas Jelinek 2016-03-07 04:33:46 EST
@Arik, any thoughts?
Comment 4 Arik 2016-04-10 09:42:04 EDT
(In reply to Tomas Jelinek from comment #3)
> @Arik, any thoughts?

It seems that by design admin roles are not inherited from clusters to VMs.
Therefore it is definitely not something for a z-stream.

Allan, could you please elaborate on the implication on the user? is something missing in the UI? are there specific operations the user cannot do because of this?
Comment 5 Tomas Jelinek 2016-04-14 08:33:26 EDT
since it is by design pushing out of 3.6.6.
Setting to 4.0 in case we will get to some enhancement we want to implement.
Comment 6 Yaniv Lavi 2016-05-09 07:00:50 EDT
oVirt 4.0 Alpha has been released, moving to oVirt 4.0 Beta target.
Comment 15 Michal Skrivanek 2016-07-21 08:10:47 EDT
this works as per design. We need to review the design
Comment 16 Michal Skrivanek 2016-07-28 03:53:47 EDT
is there any input/feedback from infra about how roles work?
Comment 22 Tomas Jelinek 2016-08-15 02:52:25 EDT
As explained by infra in comment 21: There is a difference if you use the user level api or admin level (e.g. the UI user portal vs webadmin; in REST Filter: true vs false header).
If you use the user level API, you need to assign user roles (in this case UserVmManager, not superuser).

This is by design, closing as not a bug.
If this is a big issue or someone has a good use case to change it, please reopen as RFE.

Note You need to log in before you can comment on or make changes to this bug.