Red Hat Bugzilla – Bug 950570
User Portal refresh does not update VM list according to user permissions
Last modified: 2015-09-22 09:09 EDT
Description of problem: User Portal refresh (automatic, manual clicking on refresh button, Ctrl-r in a browser [FF17, IE10], Ctrl-F5 [hard refresh] in the browsers) does not update VM list according to user real permissions. It means when a user when he is logged into User Portal becomes member of an AD group which has UserRole (on system), the VM list is not updated to include all VMs related to UserRole of the group. The VM list still contains only direct permission of the user (user->UserRole->specific VM) during whole User Portal session. Signing off and logging in the User Portal again makes the VM list include even VMs which are related to group permission. Seems to be regression, BZ806792, as it sounds it was working. Version-Release number of selected component (if applicable): sf13 How reproducible: 100% Steps to Reproduce: 1. have an AD user 2. have an AD group 3. assing UserRole permission on a VM to this AD user 4. assing UserRole permission on _system_ to this AD group 6. login into User Portal as the AD user 7. update the AD user properties on Directory server to be member of the AD group (step 2) 8. wait 5 seconds (default automatic refresh), click refresh button, browser soft-refresh, browser hard-refresh 9. logoff && log in Actual results: 8 - nothing happens, no group permissions related VM appear in the list 9 - now group permissions related VM appear in the list Expected results: 8 - autorefresh should check again user's permissions and add other vms in the list Additional info: nothing in engine.log
It seems to me that roles a user or group has are rechecked "internally" only. For example: user has UserRole, group has UserRole, then you add admin role to the group, refresh would find it. But when you add the user to a group and the engine did not know before he has been in this group, it won't recheck AD...
It is probably not feasible to reflect the Active Directory user and group configuration changes to user session on server very frequently (e.g. every cca 5 seconds when using automatic refresh). Yair, please, can you confirm, is there an automatic mechanism which updates the user sessions regularly - after some time interval (asynchronously) - I noticed on Engine channel, you plan a refactoring of the authentication/authorization module nowadays. http://www.ovirt.org/DomainInfrastructure
yair, comment #3 relevant? do we have or plan to have an update in background for user's permissions?
the refresh period is by default one hour. Or on relogin We'd suggest to either change the refresh period via engine-config (UserRefreshRate) or/and add release note that the refresh occurs on relogin and in a defined interval only. moving to docs
this was always the behavior, removing Regression
Cheryn has already documented this bug in the release notes, so I'm closing it to move it off my queue.