Red Hat Bugzilla – Bug 1421878
API request is not returning expected result for LDAP user
Last modified: 2018-03-01 08:09:24 EST
Description of problem: When using the Rest API as the local admin user I can use this url to retrieve the request. https://hostname/api/requests/11000000007200 When using the Rest API as an active directory user using this url i get a 404 https://hostname/api/requests/11000000007200 404 Not Found however, as the same active directory user i can use this url to get the same data returned https://hostname/api/provision_requests/11000000007200 I would expect both api/provision_requests and api/requests to behave the same way. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Matt, could you retest this please in 5.6.4?
Matt, Were you able to retest as per https://bugzilla.redhat.com/show_bug.cgi?id=1421878#c3 ? It looks like there are a couple of things going on here: 1. In the requests API, we limit GETs to either the requester if they are not admin. We don't do this for provision requests, hence the inconsistency in results. IMO we should fix this, but it's a separate issue - fixing it would only make the core issue here more apparent 2. In order to do (1), we ask the current user if they are admin. This must be returning true (as expected) if you are signing in locally, and returning false when using LDAP. If this is the case we need to address that, but it's not specifically an API issue.
Fixed in https://github.com/ManageIQ/manageiq/pull/15151 Matt, I have addressed (2) above, so cancelling needinfo request
Note: This will also require https://github.com/ManageIQ/manageiq/pull/15163 to fix, I'll move this to POST when that gets merged.
Verified that the LDAP admin user (with EvmGroup-super_administrator group) can access both /api/requests and /api/provision_requests.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:0380