Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2208588 - Unable to access Satellite 6 API using non-admin users.
Summary: Unable to access Satellite 6 API using non-admin users.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Users & Roles
Version: 6.12.4
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: 6.15.0
Assignee: Adam Ruzicka
QA Contact: Lukáš Hellebrandt
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-05-19 16:45 UTC by Akshay Kapse
Modified: 2024-04-23 17:11 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2024-04-23 17:11:17 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 36449 0 Normal Closed Unable to access Satellite 6 API using non-admin users. 2023-06-27 08:09:49 UTC
Red Hat Issue Tracker SAT-17947 0 None None None 2023-05-29 15:29:39 UTC
Red Hat Knowledge Base (Solution) 7014281 0 None None None 2023-05-19 16:56:36 UTC
Red Hat Product Errata RHSA-2024:2010 0 None None None 2024-04-23 17:11:19 UTC

Description Akshay Kapse 2023-05-19 16:45:31 UTC 
Unable to access Satellite 6 API using non-admin users.

Description of problem:

Non-Admin Users cannot access API, no matter which roles has been assigned to them.

The same user will be able to access, when you mark the user as "ADMIN".

Tested on Satellite 6.11, 6.12, 6.13

Version-Release number of selected component (if applicable):

How reproducible:
100 %

Steps to Reproduce:
1. Create a user "NA-USER" on Satellite GUI but don't mark it as Admin.

2. Assign all the Roles to the user "NA-USER" but don't mark it as "Admin" and then try accessing the API:

3. Try to access the API https://satellite.example.com/api/v2/



Actual results:
~~~
error	
message	"Access denied"
details	"Missing one of the required permissions: "
missing_permissions	[]
~~~


Expected results:
Should have some role which can allow non-admin users to access api.


Additional info:
If I mark the same user as Admin, it will be able to access the API successfully and will be able to see the result as well.

Similar bug which got resolved on Satellite version 6.8: https://bugzilla.redhat.com/show_bug.cgi?id=1757394

Upstream Foreman Issue Tracker for Satelltie 6.8: https://projects.theforeman.org/issues/28405
Comment 1 Adam Ruzicka 2023-05-19 16:57:36 UTC 
What do you expect to get from that particular endpoint?
Comment 2 Akshay Kapse 2023-05-19 17:08:28 UTC 
Hello,

If we check non-admin user as "Administrator" it shows API details.
Can we have some role for that so that non-admin user can get idea about API calls while using them?


Thanks,
Comment 4 Adam Ruzicka 2023-05-29 15:28:19 UTC 
Created redmine issue https://projects.theforeman.org/issues/36449 from this bug
Comment 5 Bryan Kearney 2023-06-08 16:03:58 UTC 
Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/36449 has been resolved.
Comment 8 Brad Buckingham 2023-10-30 11:29:29 UTC 
Bulk setting Target Milestone = 6.15.0 where sat-6.15.0+ is set.
Comment 9 Lukáš Hellebrandt 2023-12-06 10:47:53 UTC 
Verified with Sat 6.15.0 snap 1.0.

$ curl -k -utest_noperms:changeme -H "Content-Type: application/json" https://<FQDN>/api/v2 | pprint | grep "List all hosts"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 51793  100 51793    0     0  49705      0  0:00:01  0:00:01 --:--:-- 49705
            "List all hosts": "/api/hosts",
$ curl -k -utest_allperms:changeme -H "Content-Type: application/json" https://<FQDN>/api/v2 | pprint | grep "List all hosts"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 51793  100 51793    0     0  58457      0 --:--:-- --:--:-- --:--:-- 58391
            "List all hosts": "/api/hosts", 
$ curl -k -uadmin:changeme -H "Content-Type: application/json" https://<FQDN>/api/v2 | pprint | grep "List all hosts"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 51793  100 51793    0     0  15728      0  0:00:03  0:00:03 --:--:-- 15728
            "List all hosts": "/api/hosts",
$ curl -k -utest_noperms:changeme -H "Content-Type: application/json" https://<FQDN>/api/v2/hosts | pprint
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   144    0   144    0     0    283      0 --:--:-- --:--:-- --:--:--   282
{
    "error": {
        "message": "Access denied",
        "details": "Missing one of the required permissions: view_hosts",
        "missing_permissions": [
            "view_hosts"
        ]
    }
}
Comment 12 errata-xmlrpc 2024-04-23 17:11:17 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.15.0 release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2024:2010
Note You need to log in before you can comment on or make changes to this bug.