Bug 1420310 – User actions should succeed regardless of 'filter' parameter

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1420310 - User actions should succeed regardless of 'filter' parameter

Summary:	User actions should succeed regardless of 'filter' parameter

Status:	CLOSED CURRENTRELEASE

Aliases:	None

Product:	ovirt-engine
Classification:	oVirt
Component:	RestAPI (Show other bugs)
Sub Component:
Version:	4.1.0
Hardware:	Unspecified Unspecified

Priority	unspecified Severity medium (vote)
Target Milestone:	ovirt-4.2.0
Target Release:	4.2.0
Assigned To:	Juan Hernández
QA Contact:	Radim Hrazdil
Docs Contact:

URL:
Whiteboard:
Keywords:	ZStream

Depends On:
Blocks:	1427987
	Show dependency tree / graph

Reported:	2017-02-08 07:29 EST by Daniel Erez
Modified:	2018-04-11 10:56 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	Release Note
Doc Text:	With this update, an issue with the the way that the API supports the 'filter' parameter to indicate if results should be filtered according to the permissions of the user has been corrected. Previously, due to the way this was implemented, non-admin users needed to set this parameter for almost all operations, as the default value was 'false'. Now, to simplify the task for non-admin users, this patch changes the default value to 'true', but only for non-admin users. If the value is explicitly given in a request it will be honored.This is a backwards compatibility breaking change, as clients that used non-admin users and did not explicitly provide the 'filter' parameter will start to behave differently. However, this is unlikely, as calls from non-admin users without the 'filter=true' are almost useless. For those unlikely cases where this may be a problem, the patch also introduces a new 'ENGINE_API_FILTER_BY_DEFAULT' configuration parameter: # # This flags indicates if 'filtering' should be enabled by default for # users that aren't administrators. # ENGINE_API_FILTER_BY_DEFAULT="true" If it is necessary to revert to the behavior of previous versions of the engine, it can be achieved by changing this parameter in a configuration file inside the '/etc/ovirt-engine/engine.conf.d' directory. For example: # echo 'ENGINE_API_FILTER_BY_DEFAULT="false"' > \ /etc/ovirt-engine/engine.conf.d/99-filter-by-default.conf # systemctl restart ovirt-engine
Story Points:	---
Clone Of:
Clones:	1427987 (view as bug list)
Environment:
Last Closed:	2017-12-20 06:24:36 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	Infra
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Flags:	rule-engine: ovirt‑4.2+ lsvaty: testing_ack+

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
oVirt gerrit	73039	master	MERGED	restapi: Set 'filter=true' by default for non admins	2017-03-01 11:15 EST
oVirt gerrit	73396	ovirt-engine-4.1	MERGED	restapi: Set 'filter=true' by default for non admins	2017-03-01 16:43 EST
oVirt gerrit	74173	ovirt-engine-4.1.1.z	MERGED	restapi: Set 'filter=true' by default for non admins	2017-03-19 06:16 EDT

Groups: None (edit)

Description Daniel Erez 2017-02-08 07:29:03 EST

Description of problem:
When a rest-api action is invoked by a user without providing 'filter' parameter, it may fail due to insufficient permissions for the internal queries.
This is problematic for the python sdk which supports 'filter' argument only for service listing (and not for actions).

E.g.
Creating a disk using sdk-python fails due to insufficient permissions for GetStorageDomainListByIdQuery / GetStorageDomainByIdQuery:

disk = disks_service.add(
    disk=types.Disk(
        name='mydisk',
        description='My disk',
        format=types.DiskFormat.RAW,
        provisioned_size=2 * 2**30,
        storage_domains=[
            types.StorageDomain(
                id='43b457ae-e3b6-434d-8a9f-b234b1976e5f',
            ),
        ],
    )
)

Version-Release number of selected component (if applicable):
4.1

How reproducible:
100%

Actual results:
Fails on 'Query execution failed due to insufficient permissions.'

Expected results:
Should succeed if the user has sufficient permissions to perform the action.

Comment 1 Martin Perina 2017-02-22 07:33:20 EST

Juan is trying to find a definitive solution for that, so targetting now to 4.2 and we can decide to retarget when we have solution ready

Comment 2 Juan Hernández 2017-02-24 06:44:12 EST

There are many possible solutions to this, all of them quite complicated. The long term solution should be to remove the 'filter' concept and just make all queries filter the results according to the permissions of the user, by default. But doing that is a very large task, far beyond what can be done in the API. The only reasonable solution to this that I see is to make set 'filter=true' the default for non admin users. That is what the proposed patch does. As that is a backwards compatibility breaking change, it also introduces a configuration parameter to revert to the old behavior, for the few cases where the old behavior will actually be needed.

Comment 3 Juan Hernández 2017-02-24 06:51:08 EST

This could also be back-ported, changing the default value of the parameter to 'false'.

Comment 5 Radim Hrazdil 2017-09-04 09:38:30 EDT

Verified in Version 4.2.0-0.0.master.20170903205106.gitb17261a.el7.centos.

Comment 6 Sandro Bonazzola 2017-12-20 06:24:36 EST

This bugzilla is included in oVirt 4.2.0 release, published on Dec 20th 2017.

Since the problem described in this bug report should be
resolved in oVirt 4.2.0 release, published on Dec 20th 2017, it has been closed with a resolution of CURRENT RELEASE.

If the solution does not work for you, please open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.