Created attachment 1710473 [details] menus Description of problem: Cluster admin login console, on the user list page, impersonate a normal user, check left menus, those menus requiring cluster admin role are not hidden to normal user. Version-Release number of selected component (if applicable): 4.6.0-0.nightly-2020-08-03-143208 How reproducible: Always Steps to Reproduce: 1.Cluster admin login console, on user list page, impersonate a normal user, check left menus 2. 3. Actual results: 1. Menus like "Compute", "Administration" are not hidden for normal user. Expected results: 2. Should hidden those menus which normal user have no right to access. Additional info:
I think the change in the API implementation from REST to GraphQL caused this bug. The GraphQL `SelfSubjectAccessReview` endpoint is returning property `allowed:true` for user impersonation action. This should be `allowed: false` based on my finding from the previous REST API implementation.
The GraphQL code changed - https://github.com/openshift/console/commit/305ca9b3769ac9dfbac2897d4a3e547cf9aaab86#diff-e68ced0804dcc8510c62688ad6f13191R221
Based on info from the https://bugzilla.redhat.com/show_bug.cgi?id=1866229#c1 assigning the issue to Rastislav since he was working on the implementation.
Checked on ocp 4.6 cluster with payload 4.6.0-0.nightly-2020-08-20-174655. Now impersonate user will show correct menus for normal user, cluster admin menus will be hidden. The bug is fixed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4196