Description of problem: When user has manipulate_permission action group, and don't have manipulate_users action group, then he can add permission to user, who is not added in the system, thus he can add user to the system. Version-Release number of selected component (if applicable): sf10 How reproducible: always Steps to Reproduce: 1. Add ClusterAdmin permissions to user1 on cluster. 2. Login as user1. 3. Add UserVmManager permissions to cluster to user who is not added to the system yet. Actual results: Action succeed. Expected results: Action fail, because ClusterAdmin don't have manipulate_users action group. If ClusterAdmin try to add user via Users tab => add user, then the action fail. Additional info: 2013-03-19 09:15:28,291 INFO [org.ovirt.engine.core.bll.AddPermissionCommand] (pool-3-thread-39) [37540286] Running command: AddPermissionCommand internal: false. Entities affected : ID: fea51314-f9bf-45a0-9c5b-3bb2085b1876 Type: VdsGroups 2013-03-19 09:15:30,037 INFO [org.ovirt.engine.core.bll.LoginUserCommand] (ajp-/127.0.0.1:8702-8) Running command: LoginUserCommand internal: false. 2013-03-19 09:15:30,045 WARN [org.ovirt.engine.core.bll.GetConfigurationValueQuery] (ajp-/127.0.0.1:8702-8) calling GetConfigurationValueQuery (ApplicationMode) with null version, using default general for version 2013-03-19 09:15:30,045 WARN [org.ovirt.engine.core.bll.GetConfigurationValueQuery] (ajp-/127.0.0.1:8702-8) calling GetConfigurationValueQuery (VdcVersion) with null version, using default general for version 2013-03-19 09:15:30,645 INFO [org.ovirt.engine.core.bll.LogoutUserCommand] (ajp-/127.0.0.1:8702-1) [107c92f4] Running command: LogoutUserCommand internal: false. 2013-03-19 09:15:37,483 INFO [org.ovirt.engine.core.bll.LoginAdminUserCommand] (ajp-/127.0.0.1:8702-15) Running command: LoginAdminUserCommand internal: false. 2013-03-19 09:15:38,270 INFO [org.ovirt.engine.core.bll.LoginUserCommand] (ajp-/127.0.0.1:8702-7) Running command: LoginUserCommand internal: false. 2013-03-19 09:15:38,281 WARN [org.ovirt.engine.core.bll.GetConfigurationValueQuery] (ajp-/127.0.0.1:8702-7) calling GetConfigurationValueQuery (ApplicationMode) with null version, using default general for version 2013-03-19 09:15:38,281 WARN [org.ovirt.engine.core.bll.GetConfigurationValueQuery] (ajp-/127.0.0.1:8702-7) calling GetConfigurationValueQuery (VdcVersion) with null version, using default general for version 2013-03-19 09:15:43,119 WARN [org.ovirt.engine.core.bll.GetConfigurationValueQuery] (ajp-/127.0.0.1:8702-18) calling GetConfigurationValueQuery (WebAdminUpperRightButtonURL) with null version, using default general for version 2013-03-19 09:16:01,531 INFO [org.ovirt.engine.core.bll.AddPermissionCommand] (pool-3-thread-39) [3b82c592] Running command: AddPermissionCommand internal: false. Entities affected : ID: fea51314-f9bf-45a0-9c5b-3bb2085b1876 Type: VdsGroups
AddPermissionCommand parameters include two fields - vdcUser and adGroup - one of them is filled with the user or group to be added a permission for (+ to be added to db in case the user/group is not in DB). We should add a check during getPermissionsSubject to check if the user/group is not a DB - and if not in db, we should check for a permission to manipulate users (similar to the check in AddUserCommand).
Closing - RHEV 3.3 Released