Bug 754696 - Creating a role linked to an LDAP group will not link existing users
Summary: Creating a role linked to an LDAP group will not link existing users
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: RHQ Project
Classification: Other
Component: Database
Version: 3.0.1
Hardware: All
OS: All
medium
unspecified
Target Milestone: ---
: ---
Assignee: RHQ Project Maintainer
QA Contact: Mike Foley
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-17 12:04 UTC by Tom Fonteyne
Modified: 2013-03-07 00:21 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-03-07 00:21:07 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 754693 0 unspecified CLOSED delete a role which is linked to an LDAP group is failing with a database constraint 2021-02-22 00:41:40 UTC

Internal Links: 754693

Description Tom Fonteyne 2011-11-17 12:04:39 UTC
Description of problem:

Creating a role linked to an LDAP group will not link existing users

Version-Release number of selected component (if applicable):

JON 2.4.1

How reproducible: always


Steps to Reproduce:
1. Have a user in LDAP which belongs to an LDAP group
2. Configure JON to use LDAP and fill in the group filter so it finds above group.
3. have said user register with JON
4. create a new role, and assign said LDAP group to it
5. Add said user to this role
6. The table RHQ_SUBJECT_ROLE_LDAP_MAP should get an entry linking the user with the role
  
Actual results:

The table RHQ_SUBJECT_ROLE_LDAP_MAP is *not* getting an entry

Expected results:

That the table RHQ_SUBJECT_ROLE_LDAP_MAP gets an entry with the proper subject_id and role_id

Additional info:

Workaround: 

Use this SQL to find subject_id and role_id:

SELECT id FROM rhq_subject WHERE name LIKE 'username';

This is the subject_id you need. For example 67890
Now get the role_id with:

SELECT id FROM rhq_role WHERE name LIKE 'rolename';

For example, returning 12345
Finally insert a new entry:

INSERT INTO RHQ_SUBJECT_ROLE_LDAP_MAP (role_id,subject_id) VALUES (12345,67890);

Comment 2 Tom Fonteyne 2011-11-29 10:47:31 UTC
workaround:

1. Have a user in LDAP which belongs to an LDAP group
2. Configure JON to use LDAP and fill in the group filter so it finds above
group.
3. have said user register with JON
4. create a new role, and assign said LDAP group to it
5. Add said user to this role
6. Have user logout and login again.

I think it would still be better to do the check in step 5 though

Comment 3 Simeon Pinder 2011-11-30 21:30:28 UTC
Basically this is a case of mixing the RHQ and LDAP Administration models as described on the following link and should be avoided: http://www.rhq-project.org/display/RHQ/Using+RHQ+and+LDAP+Authorization+Models

If you enable LDAP Group authorization, you are indicating to RHQ that you want the RHQ Server to automatically assign and update RHQ users/roles every time that an external LDAP user logs in.  Even the first assignment of the external LDAP users to the "LDAP Role" is not necessary.  In other words, after completing steps 3 and 4 to enable LDAP Group authorization, executing step 5 should not be done.  Whenever the user from step 1 logs in, the role->user assigned will be taken care of correctly.   

###
3. have said user register with JON
4. create a new role, and assign said LDAP group to it
5. Add said user to this role
6. The table RHQ_SUBJECT_ROLE_LDAP_MAP should get an entry linking the user
with the role
####

A possible enhancement here would be to display a warning message that "user<->role assignment is automatic" whenever an RHQ Role is being updated with a)an external LDAP group OR b)a user account if an external LDAP group is already assigned. 

This would address Tom's suggestion to "do the check in step 5".

Comment 4 Larry O'Leary 2013-03-07 00:21:07 UTC
As described in the previous comment this is not a bug. LDAP users get associated with a JBoss ON role based on the LDAP group the belong to and that LDAP group being assigned to the target role. This is done each time the user logs into JBoss ON.


Note You need to log in before you can comment on or make changes to this bug.