Hide Forgot
Description of problem: Even an user has UserVmManager and can practically change the cluster (ie. it does have effect), there's still a popup windows with: ~~~ Operation Canceled Error while executing action: jb-w7-x64:•User is not authorized to perform this action ~~~ ~~~ ...2016-11-02 13:15:13,899 DEBUG [org.ovirt.engine.core.bll.UpdateVmCommand] (default task-15) [f2a37a1] Checking whether user '49f5f326-5c61-436f-801c-e35b32a778df' or one of the groups he is member of, have the fo llowing permissions: ID: cb8b1462-3cb6-4bf0-b7e4-28be5702b6ac Type: VMAction group EDIT_VM_PROPERTIES with role type USER, ID: cb8b1462-3cb6-4bf0-b7e4-28be5702b6ac Type: VMAction group EDIT_ADMIN_VM_PROPERTIES with role type ADMIN 2016-11-02 13:15:13,902 DEBUG [org.ovirt.engine.core.bll.UpdateVmCommand] (default task-15) [f2a37a1] Found permission '41dad25d-8ad0-4fb5-ba50-994ad3411e4d' for user when running 'UpdateVm', on 'VM' with id 'cb8 b1462-3cb6-4bf0-b7e4-28be5702b6ac' 2016-11-02 13:15:13,904 DEBUG [org.ovirt.engine.core.bll.UpdateVmCommand] (default task-15) [f2a37a1] No permission found for user when running action 'UpdateVm', on object 'VM' for action group 'EDIT_ADMIN_VM_PR OPERTIES' with id 'cb8b1462-3cb6-4bf0-b7e4-28be5702b6ac'. 2016-11-02 13:15:13,904 INFO [org.ovirt.engine.core.bll.UpdateVmCommand] (default task-15) [f2a37a1] No permission found for user '49f5f326-5c61-436f-801c-e35b32a778df' or one of the groups he is member of, when running action 'UpdateVm', Required permissions are: Action type: 'ADMIN' Action group: 'EDIT_ADMIN_VM_PROPERTIES' Object type: 'VM' Object ID: 'cb8b1462-3cb6-4bf0-b7e4-28be5702b6ac'. 2016-11-02 13:15:13,904 WARN [org.ovirt.engine.core.bll.UpdateVmCommand] (default task-15) [f2a37a1] Validation of action 'UpdateVm' failed for user user1.com.com. Reasons: VAR__ACTION__UPDATE,VAR__TYPE__VM,USER_NOT_AUTHORIZED_TO_PERFORM_ACTION ~~~ Version-Release number of selected component (if applicable): ovirt-engine-userportal-4.0.5.5-0.1.el7ev.noarch How reproducible: 100% Steps to Reproduce: 1. have an user with UserVmManager role and an assigned VM 2. edit VM 3. change cluster (you have to have at least 2 clusters in same DC) Actual results: auth popup Expected results: either there should be no popup as the change did have the effect or the change should not be done at all and popup should have senseful message Additional info:
The operation of changing the cluster has 2 steps: 1: calling the ChangeCluster command - this one passed for you, this is why you see it as the change did have effect. 2: calling the UpdateVm - this did not pass because you missed the EDIT_ADMIN_VM_PROPERTIES. This permission is checked only if the host or the CPU pinning is changed. Could you please make sure the change of the cluster did not cause changes in the host/cpu pinning?
No idea why but I cannot reproduce, but I updated hosts. Anyway I can't reproduce today on 4.0.5-6 with hosts which up-to-date vdsm etc.