I'd suggest using usergroups for composing roles. We'd like to avoid extra complexity by adding roles nesting. User groups already support nesting and can be assigned multiple roles so I think it should cover the use case. Please let us know whether this works for customer.

We'd also like to implement some wizards for creation and managing roles, e.g. create a role "to manage all hosts in this host collection". This is already tracked in separate BZ.

Hello Marek,

Customer has confirmed they can make that work, but it uncovers a related issue.

It's difficult to see what permissions a specific user actually has from the WebUI (and from the CLI, too).  

Is there a simple way to see what access a particular user has (a consolidated rollup of filters that apply to a given user)?

we'd really like to not only see what filters a user has, but what Role provides it.  Also, if the same filter is provided by multiple Roles/Groups, we'd like to know ALL sources.

In next Satellite version, there will be more information displayed in User edit form under Roles tab. The customer could see all user groups that user has been assigned and roles that they grant - tracked under BZ 1426957. There's no page listing filters/permissions though. So this might be an RFE. It would probably be best to create a new BZ for that and close this one.

As per the discussion in C#3, I am closing this RFE and have opened another RFE for the same.

https://bugzilla.redhat.com/show_bug.cgi?id=1480424

Regards,
Anand

*** This bug has been marked as a duplicate of bug 1480424 ***