Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1462130 - Administrator checkbox unchecked under Roles tab for External authenticated users (AD+GSS-Proxy+User Groups configured)
Summary: Administrator checkbox unchecked under Roles tab for External authenticated u...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: LDAP
Version: 6.2.9
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: Unspecified
Assignee: Daniel Lobato Garcia
QA Contact: Katello QA List
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-06-16 09:27 UTC by Nagoor Shaik
Modified: 2020-07-16 09:50 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-06-21 09:07:48 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3089421 0 None None None 2017-06-21 09:03:00 UTC

Description Nagoor Shaik 2017-06-16 09:27:27 UTC 
Description of problem:
Administrator checkbox unchecked under Roles tab for External authenticated users (AD+GSS-Proxy+User Groups configured)

Version-Release number of selected component (if applicable):
Red Hat Satellite 6.2.9

How reproducible:
100% 

Steps to Reproduce:
1. Configure Satellite as per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-configuring_external_authentication-using_active_directory

2. Configure User Groups for auto-assignment of roles per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-creating_user_groups-configuring_external_user_groups

3. If a User Group is configured to assign Administrator Role, once the External User logs in, Roles are assigned and user has full access, however when you go to 

My Account >> Roles tab >> Administrator  (checkbox is still unchecked)

Actual results:
Administrator Role is assigned to External user, however Administrator Checkbox is missing on the webUI

Expected results:
Checkbox should also be enabled if a user gets Administrator Role.

Additional info:
Comment 1 Marek Hulan 2017-06-16 13:14:50 UTC 
Thanks for the report Nagoor. I believe this is expected behavior. The Administrator checkbox means that this user is "super admin" regardless of any role his or she is assigned. This flag can't be set on creation by external auth source. Only administrator can mark other users as administrators.

There's a built-in role called Manager though that contains all permissions of Satellite and can be used to delegate administration to users. Once users have Manager role, they can do nearly the same things as these super admins. The only difference is that Managers can't modify Administer -> Settings page which is considered as system settings. Therefore in your case I think that the external group should be linked to an internal user group that has this Manager role. All users within this group should be able to do all tasks.

If they can not, please report each such occurrence as a separate issue. There were some of them, such as non-superadmin can't manage activation keys etc.

Please let me know if that clarifies it. I'm happy to answer further questions but I suggest closing this BZ as NOTABUG.
Comment 3 Marek Hulan 2017-06-21 09:07:48 UTC 
Closing after the confirmation.
Note You need to log in before you can comment on or make changes to this bug.