Bug 1374505 - Unable to create a custom repository in Satellite Web UI as non-admin user
Summary: Unable to create a custom repository in Satellite Web UI as non-admin user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Users & Roles
Version: 6.2.0
Hardware: All
OS: All
medium
medium
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact: Renzo Nuccitelli
URL:
Whiteboard:
: 1375666 1391810 (view as bug list)
Depends On:
Blocks: 1316897 CEE_Sat6_Top_BZs, GSS_Sat6_Top_Bugs 1426393
TreeView+ depends on / blocked
 
Reported: 2016-09-08 21:11 UTC by dgupte
Modified: 2020-07-16 08:54 UTC (History)
23 users (show)

Fixed In Version: tfm-rubygem-katello-3.0.0.115-1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1426393 (view as bug list)
Environment:
Last Closed: 2017-05-01 13:54:38 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 16505 0 Normal Closed Unable to create a repository as non-admin user 2020-08-24 18:26:05 UTC
Red Hat Bugzilla 1447829 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Knowledge Base (Solution) 2939921 0 None None None 2017-02-22 09:38:43 UTC
Red Hat Product Errata RHBA-2017:1191 0 normal SHIPPED_LIVE Satellite 6.2.9 Async Bug Release 2017-05-01 17:49:42 UTC

Internal Links: 1447829

Description dgupte 2016-09-08 21:11:17 UTC
Description of problem:
>>
Unable to create a new repository as any non-admin user within the Web UI.  When we click the create repository button it throws error "You are not authorized to perform this action" . 

The page does load but does not populate the "Type" drop down.  

The same user is able to create a repository using the hammer cli tool.

Version-Release number of selected component (if applicable):
6.2.1

Steps to Reproduce:
>>
1. Create a non-admin user and assign role with filter  "Resource type: Product and repositories"

# hammer role filters --name  testrole
----|----------------------|--------|------------|----------|---------------------------------------------------------------------------------
ID  | RESOURCE TYPE        | SEARCH | UNLIMITED? | ROLE     | PERMISSIONS                                                                     
----|----------------------|--------|------------|----------|---------------------------------------------------------------------------------
167 | (Miscellaneous)      | none   | yes        | testrole | access_dashboard                                                                
169 | Katello::Product     | none   | no         | testrole | view_products, create_products, edit_products, destroy_products, sync_product...
----|----------------------|--------|------------|----------|---------------------------------------------------------------------------------

2.  Try to login with non-admin user and create custom repository from Satellite webui >> Content >> Products >> Select product >> Select repository tab >> Create Repository


Actual results:
>> Getting error "You are not authorized to perform this action." in satellite webui whilst creating repository.


Expected results:
>> Should able to create repository in Satellite webui with non-admin user.

Additional info:
>>
Able to create repository with hammer command:-

[root@satellite ~]# hammer -u test -p password repository create  --name newrepo --content-type 'yum' --product prod1 --organization-id 1 
Repository created

================

Logs generated when try to create repository with hammer command:-

production.log 
---------------------------
2016-09-08 16:42:26 [app] [I] Started GET "/katello/api/organizations/1/products?name=prod1" for ::1 at 2016-09-08 16:42:26 -0400
2016-09-08 16:42:26 [app] [I] Processing by Katello::Api::V2::ProductsController#index as JSON
2016-09-08 16:42:26 [app] [I]   Parameters: {"name"=>"prod1", "api_version"=>"v2", "organization_id"=>"1", "product"=>{}}
2016-09-08 16:42:26 [app] [I] Authorized user test(test test)
2016-09-08 16:42:26 [app] [I]   Rendered /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.0.0.68/app/views/katello/api/v2/products/index.json.rabl within katello/api/v2/layouts/collection (31.5ms)
2016-09-08 16:42:26 [app] [I] Completed 200 OK in 95ms (Views: 29.7ms | ActiveRecord: 21.0ms)
2016-09-08 16:42:26 [app] [I] Started POST "/katello/api/repositories" for ::1 at 2016-09-08 16:42:26 -0400
2016-09-08 16:42:26 [app] [I] Processing by Katello::Api::V2::RepositoriesController#create as JSON
2016-09-08 16:42:26 [app] [I]   Parameters: {"name"=>"newrepo2", "product_id"=>147, "content_type"=>"yum", "api_version"=>"v2", "repository"=>{"name"=>"newrepo2", "content_type"=>"yum", "product_id"=>147}}
2016-09-08 16:42:26 [app] [I] Authorized user test(test test)
2016-09-08 16:42:28 [app] [I]   Rendered /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.0.0.68/app/views/katello/api/v2/repositories/show.json.rabl within katello/api/v2/layouts/resource (32.8ms)
2016-09-08 16:42:28 [app] [I] Completed 200 OK in 2146ms (Views: 27.7ms | ActiveRecord: 57.5ms)
---------------------------


Access denied log generated when try to create repository from Web UI:-

production.log
---------------------------
2016-09-08 16:43:22 [app] [I] Started GET "/api/v2/settings?search=name+%3D+default_download_policy" for 192.168.100.1 at 2016-09-08 16:43:22 -0400
2016-09-08 16:43:22 [app] [I] Processing by Api::V2::SettingsController#index as JSON
2016-09-08 16:43:22 [app] [I]   Parameters: {"search"=>"name = default_download_policy", "apiv"=>"v2"}
2016-09-08 16:43:22 [app] [I]   Rendered api/v2/errors/access_denied.json.rabl within api/v2/layouts/error_layout (0.7ms)
2016-09-08 16:43:22 [app] [I] Filter chain halted as :authorize rendered or redirected
2016-09-08 16:43:22 [app] [I] Completed 403 Forbidden in 12ms (Views: 1.6ms | ActiveRecord: 1.5ms)
2016-09-08 16:43:22 [app] [I] Started GET "/katello/api/v2/repositories/repository_types?creatable=true&organization_id=1" for 192.168.100.1 at 2016-09-08 16:43:22 -0400
2016-09-08 16:43:22 [app] [I] Processing by Katello::Api::V2::RepositoriesController#repository_types as JSON
2016-09-08 16:43:22 [app] [I]   Parameters: {"creatable"=>"true", "organization_id"=>"1", "api_version"=>"v2"}
2016-09-08 16:43:22 [app] [I]   Rendered api/v2/errors/access_denied.json.rabl within api/v2/layouts/error_layout (1.0ms)
2016-09-08 16:43:22 [app] [I] Filter chain halted as :authorize rendered or redirected
2016-09-08 16:43:22 [app] [I] Completed 403 Forbidden in 20ms (Views: 2.6ms | ActiveRecord: 2.7ms)
2016-09-08 16:43:22 [app] [I] Started GET "/katello/api/v2/gpg_keys?full_result=true&organization_id=1" for 192.168.100.1 at 2016-09-08 16:43:22 -0400
2016-09-08 16:43:22 [app] [I] Processing by Katello::Api::V2::GpgKeysController#index as JSON
2016-09-08 16:43:22 [app] [I]   Parameters: {"full_result"=>"true", "organization_id"=>"1", "api_version"=>"v2"}
2016-09-08 16:43:22 [app] [I]   Rendered api/v2/errors/access_denied.json.rabl within api/v2/layouts/error_layout (0.7ms)
2016-09-08 16:43:22 [app] [I] Filter chain halted as :authorize rendered or redirected
2016-09-08 16:43:22 [app] [I] Completed 403 Forbidden in 22ms (Views: 1.8ms | ActiveRecord: 2.8ms)
---------------------------

Comment 2 Justin Sherrill 2016-09-13 16:02:49 UTC
*** Bug 1375666 has been marked as a duplicate of this bug. ***

Comment 4 Bryan Kearney 2016-09-26 14:18:54 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/16505 has been resolved.

Comment 7 Brad Buckingham 2016-11-07 17:45:02 UTC
*** Bug 1391810 has been marked as a duplicate of this bug. ***

Comment 25 pm-sat@redhat.com 2017-02-23 21:09:29 UTC
Please add verifications steps for this bug to help QE verify

Comment 31 Renzo Nuccitelli 2017-03-23 16:17:33 UTC
After creating the user with all Products and repositories filter I got an error while accessing Content -> Products:

Oops, we're sorry but something went wrong No route matches {:action=>"edit", :bastion_page=>"products", :controller=>"users", :id=>#<User id: 4, login: "repo", firstname: "", lastname: "", mail: "", admin: false, last_login_on: "2017-03-23 15:56:51", auth_source_id: 1, created_at: "2017-03-23 15:50:08", updated_at: "2017-03-23 15:57:22", password_hash: "7e9a927048e06783dfc1daeee798ee0e95977b66", password_salt: "041d4b8f031f6a03a481552d6ace46bbc8c087bf", locale: nil, avatar_hash: nil, default_organization_id: nil, default_location_id: nil, lower_login: "repo", mail_enabled: true, timezone: "">} missing required keys: []


Logs:

 tail production.log 
 | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/rack/thread_handler_extension.rb:77:in `process_request'
 | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/request_handler/thread_handler.rb:140:in `accept_and_process_next_request'
 | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/request_handler/thread_handler.rb:108:in `main_loop'
 | /usr/share/gems/gems/passenger-4.0.18/lib/phusion_passenger/request_handler.rb:441:in `block (3 levels) in start_threads'
 | /opt/theforeman/tfm/root/usr/share/gems/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:in `call'
 | /opt/theforeman/tfm/root/usr/share/gems/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:in `block in create_with_logging_context'
2017-03-23 12:13:43 7e78f586 [app] [I]   Rendered common/500.html.erb within layouts/application (3.6ms)
2017-03-23 12:13:43 7e78f586 [app] [I]   Rendered layouts/_application_content.html.erb (0.6ms)
2017-03-23 12:13:43 7e78f586 [app] [I]   Rendered layouts/base.html.erb (2.6ms)
2017-03-23 12:13:43 7e78f586 [app] [I] Completed 500 Internal Server Error in 43ms (Views: 9.7ms | ActiveRecord: 5.7ms)
[root@dell-pe-fm120-1a foreman]# 

Thus I am moving this back ASSIGNED

Comment 34 Justin Sherrill 2017-03-23 17:32:06 UTC
Looking at the failure, its actually completely unrelated to this issue. 

When you create a user and don't give them an email address, the user is prompted to enter one when they login.  They will not be able to do anything with the app until they provide it. 

I'm seeing a couple of issues with this 'feature':

1) its not currently telling the user they need to enter the email address
2) clicking on any bastion pages without entering the email address leads to the error you see in comment #33.

I think both of these issues are new (separate bzs).  

In Renzo's case, after entering an email address for that user, i am able to navigate to products and create a repository.  Moving back to ON_QA

Comment 36 Renzo Nuccitelli 2017-03-31 12:11:11 UTC
After setting user email I was able to see and create new repo on sat 6.2.9 snap 1.

Thus I am going to move this to VERIFIED.

About the email I created 2 other issues:

https://bugzilla.redhat.com/show_bug.cgi?id=1435409
https://bugzilla.redhat.com/show_bug.cgi?id=1435414

Comment 41 errata-xmlrpc 2017-05-01 13:54:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1191


Note You need to log in before you can comment on or make changes to this bug.