Bug 1533222 - Auth MIQLDAP AD - SSUI - When switching groups in SSUI to a user with group/role EvmGroup-desktop, user is logged out.
Summary: Auth MIQLDAP AD - SSUI - When switching groups in SSUI to a user with group/r...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: UI - Service
Version: 5.9.0
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: GA
: 5.9.0
Assignee: Allen W
QA Contact: Landon LaSmith
URL:
Whiteboard: auth:miqldap:ad:rbac
Depends On: 1531658
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-10 19:05 UTC by Satoe Imaishi
Modified: 2018-03-06 15:18 UTC (History)
8 users (show)

Fixed In Version: 5.9.0.20
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1531658
Environment:
Last Closed: 2018-03-06 15:18:11 UTC
Category: ---
Cloudforms Team: CFME Core
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Comment 3 CFME Bot 2018-01-10 19:07:34 UTC
New commit detected on ManageIQ/manageiq/gaprindashvili:
https://github.com/ManageIQ/manageiq/commit/f8e0dd3b28e4a25730eb9f74633bcbe55e1a649f

commit f8e0dd3b28e4a25730eb9f74633bcbe55e1a649f
Author:     Dan Clarizio <dclarizi>
AuthorDate: Wed Jan 10 08:36:32 2018 -0800
Commit:     Satoe Imaishi <simaishi>
CommitDate: Wed Jan 10 14:04:33 2018 -0500

    Merge pull request #16788 from AllenBW/#1531658-update-evmdesktop-product-features
    
    (cherry picked from commit eee858120a0cc8ecbfed2ca3f1a3da0823e718d5)
    
    Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1533222

 db/fixtures/miq_user_roles.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

Comment 7 Landon LaSmith 2018-01-24 19:56:38 UTC
Tested this using database auth

This yaml update doesn't enable SSUI access for EvmRole-desktop because the role doesn't have access to Services in the OPS UI.  You'll need to add service_view to the product features for EvmRole-desktop which might be outside of the scope for that role.

Enable Services->My Services->All Services->View All Services product feature, at a minimum, because SSUI access isn't granted if the corresponding OPS product feature isn't accessible.

With the default permissions, you can still login to the SSUI w/ EvmRole-user_self_service and attempt to switch to EvmRole-desktop which will immediately log you out.

Comment 8 Allen W 2018-01-25 02:41:48 UTC
Ok ok ok ok so secretly that was part 1 of the fix 😏.. WHAT dont believe me?  Well I can't blame you... anywho... here's whats going on now.. the issue is with each of these three functions: https://github.com/manageiq/manageiq-ui-service/blob/1d46737e05d4d403cba736f9d5dd200897ae25f3/client/app/states/dashboard/dashboard.state.js#L21-L24

tl;dr when any one of the above mentioned functions returns a 403 we get kicked back to login 😭 

working on a fix, inc soon

Comment 9 Allen W 2018-01-25 04:16:51 UTC
Ok, as promised, this time with 📹 proof, just so you keep me honest. 

Landon, thanks for sticking with us during this multi-part mayhem <3

Comment 10 Allen W 2018-01-25 16:38:49 UTC
Woops, forgot to include the pr link https://github.com/ManageIQ/manageiq-ui-service/pull/1372

Comment 11 Allen W 2018-01-26 16:07:08 UTC
Ok so pr for the fix got merged, but want to let yah know, a *more complete fix* is in the works here: https://github.com/ManageIQ/manageiq-ui-service/pull/1373

The fix merged resolves the issue with login, but if you switch groups from say desktop to admin, you'll be logged out.  The aforementioned pr will fix this and a number of other itty bitty bugs (sadly its still a wip).

Comment 12 CFME Bot 2018-01-26 17:41:50 UTC
New commit detected on ManageIQ/manageiq-ui-service/gaprindashvili:
https://github.com/ManageIQ/manageiq-ui-service/commit/aaaaa5d46db0fa2269712afa0171a5e3a89eb911

commit aaaaa5d46db0fa2269712afa0171a5e3a89eb911
Author:     Martin Hradil <himdel>
AuthorDate: Fri Jan 26 16:31:30 2018 +0100
Commit:     Satoe Imaishi <simaishi>
CommitDate: Fri Jan 26 12:30:24 2018 -0500

    Merge pull request #1372 from AllenBW/BZ/MASTER/#1533222-dashboard-state-resolve
    
    Refactors dashboard state resolve to return true on failed query
    (cherry picked from commit d60f84003472182d5645a99f4920277b8a890d8f)
    
    Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1533222

 client/app/states/dashboard/dashboard.state.js | 45 +++++++++++++-------------
 1 file changed, 23 insertions(+), 22 deletions(-)

Comment 13 Landon LaSmith 2018-02-09 03:35:31 UTC
VERIFIED in 5.9.0.20. I was able to login to the SSUI with external auth enabled (MIQLDAP) and change to/from the EVMGroup-desktop group without being logged out.


Note You need to log in before you can comment on or make changes to this bug.