Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1462130

Summary: Administrator checkbox unchecked under Roles tab for External authenticated users (AD+GSS-Proxy+User Groups configured)
Product: Red Hat Satellite Reporter: Nagoor Shaik <nshaik>
Component: LDAPAssignee: Daniel Lobato Garcia <dlobatog>
Status: CLOSED NOTABUG QA Contact: Katello QA List <katello-qa-list>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.2.9CC: mhulan, nshaik, sgraessl, tbrisker
Target Milestone: Unspecified   
Target Release: Unused   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-06-21 09:07:48 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nagoor Shaik 2017-06-16 09:27:27 UTC 
Description of problem:
Administrator checkbox unchecked under Roles tab for External authenticated users (AD+GSS-Proxy+User Groups configured)

Version-Release number of selected component (if applicable):
Red Hat Satellite 6.2.9

How reproducible:
100% 

Steps to Reproduce:
1. Configure Satellite as per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-configuring_external_authentication-using_active_directory

2. Configure User Groups for auto-assignment of roles per https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/server_administration_guide/sect-red_hat_satellite-server_administration_guide-creating_user_groups-configuring_external_user_groups

3. If a User Group is configured to assign Administrator Role, once the External User logs in, Roles are assigned and user has full access, however when you go to 

My Account >> Roles tab >> Administrator  (checkbox is still unchecked)

Actual results:
Administrator Role is assigned to External user, however Administrator Checkbox is missing on the webUI

Expected results:
Checkbox should also be enabled if a user gets Administrator Role.

Additional info:
Comment 1 Marek Hulan 2017-06-16 13:14:50 UTC 
Thanks for the report Nagoor. I believe this is expected behavior. The Administrator checkbox means that this user is "super admin" regardless of any role his or she is assigned. This flag can't be set on creation by external auth source. Only administrator can mark other users as administrators.

There's a built-in role called Manager though that contains all permissions of Satellite and can be used to delegate administration to users. Once users have Manager role, they can do nearly the same things as these super admins. The only difference is that Managers can't modify Administer -> Settings page which is considered as system settings. Therefore in your case I think that the external group should be linked to an internal user group that has this Manager role. All users within this group should be able to do all tasks.

If they can not, please report each such occurrence as a separate issue. There were some of them, such as non-superadmin can't manage activation keys etc.

Please let me know if that clarifies it. I'm happy to answer further questions but I suggest closing this BZ as NOTABUG.
Comment 3 Marek Hulan 2017-06-21 09:07:48 UTC 
Closing after the confirmation.