Red Hat Bugzilla – Bug 1374505
Unable to create a custom repository in Satellite Web UI as non-admin user
Last modified: 2017-06-18 22:42:26 EDT
Description of problem: >> Unable to create a new repository as any non-admin user within the Web UI. When we click the create repository button it throws error "You are not authorized to perform this action" . The page does load but does not populate the "Type" drop down. The same user is able to create a repository using the hammer cli tool. Version-Release number of selected component (if applicable): 6.2.1 Steps to Reproduce: >> 1. Create a non-admin user and assign role with filter "Resource type: Product and repositories" # hammer role filters --name testrole ----|----------------------|--------|------------|----------|--------------------------------------------------------------------------------- ID | RESOURCE TYPE | SEARCH | UNLIMITED? | ROLE | PERMISSIONS ----|----------------------|--------|------------|----------|--------------------------------------------------------------------------------- 167 | (Miscellaneous) | none | yes | testrole | access_dashboard 169 | Katello::Product | none | no | testrole | view_products, create_products, edit_products, destroy_products, sync_product... ----|----------------------|--------|------------|----------|--------------------------------------------------------------------------------- 2. Try to login with non-admin user and create custom repository from Satellite webui >> Content >> Products >> Select product >> Select repository tab >> Create Repository Actual results: >> Getting error "You are not authorized to perform this action." in satellite webui whilst creating repository. Expected results: >> Should able to create repository in Satellite webui with non-admin user. Additional info: >> Able to create repository with hammer command:- [root@satellite ~]# hammer -u test -p password repository create --name newrepo --content-type 'yum' --product prod1 --organization-id 1 Repository created ================ Logs generated when try to create repository with hammer command:- production.log --------------------------- 2016-09-08 16:42:26 [app] [I] Started GET "/katello/api/organizations/1/products?name=prod1" for ::1 at 2016-09-08 16:42:26 -0400 2016-09-08 16:42:26 [app] [I] Processing by Katello::Api::V2::ProductsController#index as JSON 2016-09-08 16:42:26 [app] [I] Parameters: {"name"=>"prod1", "api_version"=>"v2", "organization_id"=>"1", "product"=>{}} 2016-09-08 16:42:26 [app] [I] Authorized user test(test test) 2016-09-08 16:42:26 [app] [I] Rendered /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.0.0.68/app/views/katello/api/v2/products/index.json.rabl within katello/api/v2/layouts/collection (31.5ms) 2016-09-08 16:42:26 [app] [I] Completed 200 OK in 95ms (Views: 29.7ms | ActiveRecord: 21.0ms) 2016-09-08 16:42:26 [app] [I] Started POST "/katello/api/repositories" for ::1 at 2016-09-08 16:42:26 -0400 2016-09-08 16:42:26 [app] [I] Processing by Katello::Api::V2::RepositoriesController#create as JSON 2016-09-08 16:42:26 [app] [I] Parameters: {"name"=>"newrepo2", "product_id"=>147, "content_type"=>"yum", "api_version"=>"v2", "repository"=>{"name"=>"newrepo2", "content_type"=>"yum", "product_id"=>147}} 2016-09-08 16:42:26 [app] [I] Authorized user test(test test) 2016-09-08 16:42:28 [app] [I] Rendered /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.0.0.68/app/views/katello/api/v2/repositories/show.json.rabl within katello/api/v2/layouts/resource (32.8ms) 2016-09-08 16:42:28 [app] [I] Completed 200 OK in 2146ms (Views: 27.7ms | ActiveRecord: 57.5ms) --------------------------- Access denied log generated when try to create repository from Web UI:- production.log --------------------------- 2016-09-08 16:43:22 [app] [I] Started GET "/api/v2/settings?search=name+%3D+default_download_policy" for 192.168.100.1 at 2016-09-08 16:43:22 -0400 2016-09-08 16:43:22 [app] [I] Processing by Api::V2::SettingsController#index as JSON 2016-09-08 16:43:22 [app] [I] Parameters: {"search"=>"name = default_download_policy", "apiv"=>"v2"} 2016-09-08 16:43:22 [app] [I] Rendered api/v2/errors/access_denied.json.rabl within api/v2/layouts/error_layout (0.7ms) 2016-09-08 16:43:22 [app] [I] Filter chain halted as :authorize rendered or redirected 2016-09-08 16:43:22 [app] [I] Completed 403 Forbidden in 12ms (Views: 1.6ms | ActiveRecord: 1.5ms) 2016-09-08 16:43:22 [app] [I] Started GET "/katello/api/v2/repositories/repository_types?creatable=true&organization_id=1" for 192.168.100.1 at 2016-09-08 16:43:22 -0400 2016-09-08 16:43:22 [app] [I] Processing by Katello::Api::V2::RepositoriesController#repository_types as JSON 2016-09-08 16:43:22 [app] [I] Parameters: {"creatable"=>"true", "organization_id"=>"1", "api_version"=>"v2"} 2016-09-08 16:43:22 [app] [I] Rendered api/v2/errors/access_denied.json.rabl within api/v2/layouts/error_layout (1.0ms) 2016-09-08 16:43:22 [app] [I] Filter chain halted as :authorize rendered or redirected 2016-09-08 16:43:22 [app] [I] Completed 403 Forbidden in 20ms (Views: 2.6ms | ActiveRecord: 2.7ms) 2016-09-08 16:43:22 [app] [I] Started GET "/katello/api/v2/gpg_keys?full_result=true&organization_id=1" for 192.168.100.1 at 2016-09-08 16:43:22 -0400 2016-09-08 16:43:22 [app] [I] Processing by Katello::Api::V2::GpgKeysController#index as JSON 2016-09-08 16:43:22 [app] [I] Parameters: {"full_result"=>"true", "organization_id"=>"1", "api_version"=>"v2"} 2016-09-08 16:43:22 [app] [I] Rendered api/v2/errors/access_denied.json.rabl within api/v2/layouts/error_layout (0.7ms) 2016-09-08 16:43:22 [app] [I] Filter chain halted as :authorize rendered or redirected 2016-09-08 16:43:22 [app] [I] Completed 403 Forbidden in 22ms (Views: 1.8ms | ActiveRecord: 2.8ms) ---------------------------
*** Bug 1375666 has been marked as a duplicate of this bug. ***
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/16505 has been resolved.
*** Bug 1391810 has been marked as a duplicate of this bug. ***
Please add verifications steps for this bug to help QE verify
After creating the user with all Products and repositories filter I got an error while accessing Content -> Products: Oops, we're sorry but something went wrong No route matches {:action=>"edit", :bastion_page=>"products", :controller=>"users", :id=>#<User id: 4, login: "repo", firstname: "", lastname: "", mail: "", admin: false, last_login_on: "2017-03-23 15:56:51", auth_source_id: 1, created_at: "2017-03-23 15:50:08", updated_at: "2017-03-23 15:57:22", password_hash: "7e9a927048e06783dfc1daeee798ee0e95977b66", password_salt: "041d4b8f031f6a03a481552d6ace46bbc8c087bf", locale: nil, avatar_hash: nil, default_organization_id: nil, default_location_id: nil, lower_login: "repo", mail_enabled: true, timezone: "">} missing required keys: [] Logs: tail production.log | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/rack/thread_handler_extension.rb:77:in `process_request' | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/request_handler/thread_handler.rb:140:in `accept_and_process_next_request' | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/request_handler/thread_handler.rb:108:in `main_loop' | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/request_handler.rb:441:in `block (3 levels) in start_threads' | /opt/theforeman/tfm/root/usr/share/gems/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:in `call' | /opt/theforeman/tfm/root/usr/share/gems/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:in `block in create_with_logging_context' 2017-03-23 12:13:43 7e78f586 [app] [I] Rendered common/500.html.erb within layouts/application (3.6ms) 2017-03-23 12:13:43 7e78f586 [app] [I] Rendered layouts/_application_content.html.erb (0.6ms) 2017-03-23 12:13:43 7e78f586 [app] [I] Rendered layouts/base.html.erb (2.6ms) 2017-03-23 12:13:43 7e78f586 [app] [I] Completed 500 Internal Server Error in 43ms (Views: 9.7ms | ActiveRecord: 5.7ms) [root@dell-pe-fm120-1a foreman]# Thus I am moving this back ASSIGNED
Looking at the failure, its actually completely unrelated to this issue. When you create a user and don't give them an email address, the user is prompted to enter one when they login. They will not be able to do anything with the app until they provide it. I'm seeing a couple of issues with this 'feature': 1) its not currently telling the user they need to enter the email address 2) clicking on any bastion pages without entering the email address leads to the error you see in comment #33. I think both of these issues are new (separate bzs). In Renzo's case, after entering an email address for that user, i am able to navigate to products and create a repository. Moving back to ON_QA
After setting user email I was able to see and create new repo on sat 6.2.9 snap 1. Thus I am going to move this to VERIFIED. About the email I created 2 other issues: https://bugzilla.redhat.com/show_bug.cgi?id=1435409 https://bugzilla.redhat.com/show_bug.cgi?id=1435414
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1191