Feature #10900: Ship all built-in roles as read-only and provide a way to clone roles - Foreman

Custom queries

3.11.4 release DONE
3.11.4 release TODO
3.12.1 release DONE
3.12.1 release TODO
3.13.0 release DONE
3.13.0 release TODO
All bugs by votes
All issues closed in the last 3 weeks
Easy and Trivial Issues
Easy Issues (only)
Foreman - new open issues in last 10 days
Good first issues - Foreman core
high prio open bugs
Host registration [open]
Mine
My issues closed in the last 3 weeks
old bugs
Open with target version set (aka blockers)
registration
taken-none
Team Atlas untriaged bugs
templates
Trivial Issues
Untriaged and opened in the past two weeks

Actions

Copy link

Feature #10900

open

Ship all built-in roles as read-only and provide a way to clone roles

Added by Lukas Zapletal over 9 years ago. Updated over 9 years ago.

Status:

New

Priority:

Normal

Assignee:

Category:

Users, Roles and Permissions

Target version:

Difficulty:

Triaged:

Bugzilla link:

Pull request:

Fixed in Releases:

Found in Releases:

Red Hat JIRA:

Description

We currently do not support adding permissions to existing roles:

role "Existing Role", [:existing_perm, :new_perm]

In this case, new_perm is simply ignored. We need this in Discovery.

Related issues 2 (0 open — 2 closed)

	Related to Discovery - Bug #10898: Auto-provision a host via Discovery_Manager role rasies undefined method	Closed	Lukas Zapletal	06/22/2015			Actions
	Related to Foreman - Feature #11206: Provide a way to list default role permissions for plugins	Closed	Lukas Zapletal	07/24/2015			Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by Lukas Zapletal over 9 years ago

Related to Bug #10898: Auto-provision a host via Discovery_Manager role rasies undefined method added

Actions

Copy link

Updated by Marek Hulán over 9 years ago

Category set to Plugin integration

Actions

Copy link

Updated by Lukas Zapletal over 9 years ago

Subject changed from Role DSL does not support adding permissions to existing roles to Add permission validator for roles
Category changed from Plugin integration to Security

Ok this is a feature. We do not want to add permissions back when roles are modified by
administrators. Therefore users need to add the permissions themselves.
Until roles are read only or we have some kind of validation that would
ask admin to add missing permission, that's the only way I think.

We can only make this easier to administrators by providing some kind of validation to find missing permissions. This could be a rake task maybe: permissions:default_validate and permissions:default_reset

Actions

Copy link

Updated by Lukas Zapletal over 9 years ago

Alternatively, if permissions are never deleted from database but "disabled", then we can add them easily and also validation woudl be trivial.

Actions

Copy link

Updated by Lukas Zapletal over 9 years ago

Subject changed from Add permission validator for roles to Ship all built-in roles as read-only and provide a way to clone roles

This task will need to make sure all the roles in existing installation are correct before making them read-only. Perhaps via a migration with user explicitly confirming if there were some permission added back.

Validator rake task was shipped with https://github.com/theforeman/foreman/commit/758d57a3c067dbd07f5bfbd66617b6865dab9d66 and it will be useful for detecting incorrect permissions after we implement this feature.

Actions

Copy link