Red Hat Bugzilla – Bug 969887
New admin user sees permission errors from Foreman when creating users, organizations
Last modified: 2014-07-02 10:09:09 EDT
Description of problem: I created a new user via Katello UI with the Administrator role assigned to it. I then logged out from Katello UI and logged back in as the new super user. Trying to create new users and organizations succeeded from Katello but several error messages were displayed as shown below: Failed to perform additional action KatelloForemanEngine::Actions::UserCreate: 403 Forbidden Version-Release number of selected component (if applicable): * apr-util-ldap-1.3.9-3.el6_0.1.x86_64 * candlepin-0.8.9-1.el6_4.noarch * candlepin-cert-consumer-qeblade35.rhq.lab.eng.bos.redhat.com-1.0-1.noarch * candlepin-scl-1-5.el6_4.noarch * candlepin-scl-quartz-2.1.5-5.el6_4.noarch * candlepin-scl-rhino-1.7R3-1.el6_4.noarch * candlepin-scl-runtime-1-5.el6_4.noarch * candlepin-selinux-0.8.9-1.el6_4.noarch * candlepin-tomcat6-0.8.9-1.el6_4.noarch * elasticsearch-0.19.9-8.el6sat.noarch * foreman-1.1.10002-44.noarch * foreman-installer-puppet-concat-0-2.d776701.git.0.21ef926.el6sat.noarch * foreman-installer-puppet-dhcp-0-5.3a4a13c.el6sat.noarch * foreman-installer-puppet-dns-0-7.fcae203.el6sat.noarch * foreman-installer-puppet-foreman-0-6.568c5c4.el6sat.noarch * foreman-installer-puppet-foreman_proxy-0-8.bd1e35d.el6sat.noarch * foreman-installer-puppet-puppet-0-3.ab46748.el6sat.noarch * foreman-installer-puppet-tftp-0-5.ea6c5e5.el6sat.noarch * foreman-installer-puppet-xinetd-0-50a267b8.git.0.44aca6a.el6sat.noarch * foreman-postgresql-1.1.10002-44.noarch * foreman-proxy-1.1.10002-1.el6sat.noarch * foreman-proxy-installer-1.0.1-8.f5ae2cd.el6sat.noarch * katello-1.4.2-8.el6sat.noarch * katello-all-1.4.2-8.el6sat.noarch * katello-candlepin-cert-key-pair-1.0-1.noarch * katello-certs-tools-1.4.2-2.el6sat.noarch * katello-cli-1.4.2-6.el6sat.noarch * katello-cli-common-1.4.2-6.el6sat.noarch * katello-common-1.4.2-8.el6sat.noarch * katello-configure-1.4.3-12.el6sat.noarch * katello-configure-foreman-1.4.3-12.el6sat.noarch * katello-foreman-all-1.4.2-8.el6sat.noarch * katello-glue-candlepin-1.4.2-8.el6sat.noarch * katello-glue-elasticsearch-1.4.2-8.el6sat.noarch * katello-glue-pulp-1.4.2-8.el6sat.noarch * katello-qpid-broker-key-pair-1.0-1.noarch * katello-qpid-client-key-pair-1.0-1.noarch * katello-selinux-1.4.3-3.el6sat.noarch * openldap-2.4.23-31.el6.x86_64 * pulp-rpm-plugins-2.1.1-1.el6sat.noarch * pulp-selinux-2.1.1-1.el6sat.noarch * pulp-server-2.1.1-1.el6sat.noarch * python-ldap-2.3.10-1.el6.x86_64 * ruby193-rubygem-ldap_fluff-0.1.7-3.el6sat.noarch * ruby193-rubygem-net-ldap-0.2.2-7.el6_4.noarch * signo-0.0.15-1.el6sat.noarch * signo-katello-0.0.15-1.el6sat.noarch How reproducible: Steps to Reproduce: 1. As the admin user, create a new user with administrator role from Katello 2. Log out and log back in as the new super user 3. Try to create new users and organizations 4. Try to delete users and organizations Actual results: Even though the user/organization gets created/deleted from the UI, there's an error from Foreman displayed Expected results: Additional info:
Created attachment 756122 [details] stacktrace
This is pretty old -- could QA verify if this is still an issue?
Definitely still an issue, tested on MDP2, SNAP8: Failed to perform additional action KatelloForemanEngine::Actions::UserCreate: 403 Forbidden that said, lets just punt this since it is being addressed directly in MDP3 with the Engine work.
Subject to bug #868910 being outstanding, this should otherwise work for deleting users other than the admin user.
Verified in Satellite-6.0.3-RHEL-6-20140520.2 - newly created user with admin privs can CRUD user/orgs, etc. I gave this a good once-over, if we find other areas where a newly-created admin account does not work, we'll create a new, specific bz.
This was delivered in 6.0.3, the Beta version of Satellite 6.0
This was delivered with 6.0.3, which is the Satellite 6 Beta.