Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

At the present time create_systems permissions (which is given to those wanting to register a system to an environment or an org) automatically gives CRUD permissions for all the systems in Environment/Organizations. To manage systems better we need a more fine grained control.

Proposal

1) Change :create_systems verb in environment and org resources to :register_systems . Update the verbs in those models to reflect this.
2) Remove the permission cascade logic in environment/org and systems models

Regarding this issue, I have pushed a simple workaround to allow registration without activation keys.

1634bdc 736384 - workaround for perm. denied for rhsm registration

This should be removed when we refactor permissions for system activations.

Ok. After some dicsussion it turns out the best way is to remove create method, remove it from api controllers and create register method instead.

I will assume the current API for subscription manager remains uneffected.

Pushed.

eebb966 736141 - Systems Registration perms need to be reworked

@Parta - could you review my change please?

@Bryan - yes no change in the RHSM API.

And rhsm is also now covered with nice system testing:

089efb4 737563 - adding more rhsm system testing

@Partha - no objections ;-) Putting ON_QA.