Description of problem: Administrator checkbox unchecked under Roles tab for External authenticated users (AD+GSS-Proxy+User Groups configured) Version-Release number of selected component (if applicable): Red Hat Satellite 6.2.9 How reproducible: 100% Steps to Reproduce: 1. Configure Satellite as per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-configuring_external_authentication-using_active_directory 2. Configure User Groups for auto-assignment of roles per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-creating_user_groups-configuring_external_user_groups 3. If a User Group is configured to assign Administrator Role, once the External User logs in, Roles are assigned and user has full access, however when you go to My Account >> Roles tab >> Administrator (checkbox is still unchecked) Actual results: Administrator Role is assigned to External user, however Administrator Checkbox is missing on the webUI Expected results: Checkbox should also be enabled if a user gets Administrator Role. Additional info:
Thanks for the report Nagoor. I believe this is expected behavior. The Administrator checkbox means that this user is "super admin" regardless of any role his or she is assigned. This flag can't be set on creation by external auth source. Only administrator can mark other users as administrators. There's a built-in role called Manager though that contains all permissions of Satellite and can be used to delegate administration to users. Once users have Manager role, they can do nearly the same things as these super admins. The only difference is that Managers can't modify Administer -> Settings page which is considered as system settings. Therefore in your case I think that the external group should be linked to an internal user group that has this Manager role. All users within this group should be able to do all tasks. If they can not, please report each such occurrence as a separate issue. There were some of them, such as non-superadmin can't manage activation keys etc. Please let me know if that clarifies it. I'm happy to answer further questions but I suggest closing this BZ as NOTABUG.
Closing after the confirmation.