Red Hat Bugzilla – Bug 1530162
Viewer should be able to view and process template for external creation flow
Last modified: 2018-03-27 05:44:06 EDT
Description of problem: viewer should be granted the permission to go on to view and process template when he is on external creation from template flow. Version-Release number of selected component (if applicable): v3.9.0-0.9.0 How reproducible: Always Steps to Reproduce: 1.Cluster admin create template under openshift $ oc create -f https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/templates/ui/application-template-stibuild-without-customize-route.json --config=<admin.config> 2.User1 create project and add view role to user2 $ oc new-project test $ oc policy add-role-to-user view user2 -n test 3.User2 login to web console and access create from template external page https://<master>/console/create?template=ruby-helloworld-sample&templateParamsMap={%22ADMIN_USERNAME%22:%22adminuser%22} 4.Select project "test" in Choose Existing Project 5.Click Next Actual results: 5.Error occured with message: Error Access denied You do not have authority to process templates in project test. Expected results: 5. User2 should be able to go on after click "Next" to view and process the template until he hit "Create",user2 don't have permission to create resources processed from template "ruby-helloworld-sample" in project "test" since user2 is viewer, thus he will get error message. Additional info:
I'm pretty sure this was the intentional design so that the user doesn't start filling out a form they won't be able to submit. The user does not have the authority to process templates in that namespace, we have to flag that somewhere. We could potentially do better and warn them at the point where they selected the project. Similar to what we are now doing in the new add to project dialogs.
For what it's worth, the behavior is consistent with the old catalog (e.g., /project/user1project/create) as create from url simply advances the user in to the old catalog create flow. I wonder if the simple fix is to remove view-only projects from create from url's choose existing project dropdown (or disable them in the dropdown). If you can't create in the project, no point letting you select the project?
It's an expensive check. If you have a lot of projects, it's not practical to filter the list up front unfortunately.
We found the inconsistent behavior in automation testing, in OCP 3.7, viewer was able to go on to fill out the form and get error "An error occurred processing the template" when he submit the creation. It is better if we could keep consistent behavior?
I see the message "You are not authorized to add to this project." with the "Create" button disabled in the new 3.7 template dialog. Is that not what you see?
PR to resolve: https://github.com/openshift/origin-web-console/pull/2622
(In reply to Samuel Padgett from comment #5) > I see the message "You are not authorized to add to this project." with the > "Create" button disabled in the new 3.7 template dialog. Is that not what > you see? Attached gif is what I see when creating from url with viewer
Robb's fix from comment #6 should make the two consistent where you see the error when picking the project.
Yeah, I will give a test after getting a testable puddle
Same issue with bug 1510786 Move to VERIFIED