Project

General

Profile

Actions

Bug #36726

closed

Non-admin user cannot list an individual smart proxy but can list all smart proxies

Added by Quinn James 10 months ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Foreman Proxy Content
Target version:
Difficulty:
Triaged:
Yes
Fixed in Releases:
Found in Releases:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=2096930

Description of problem:

This bug is even more relevant because the bootstrap.py script uses the /katello/api/capsules/<capsule_id> API endpoint to migrate hosts between capsules.

API requests to /katello/api/capsules/<some_capsule_id> fail if run by a non-admin user, even if said user has all roles. As soon as we enable the admin flag for the user, the same API request works and returns information about the individual capsule.

In contrast, requests to /katello/api/capsules succeed without requiring the admin flag.

The information returned by the latter includes 100% of the information returned by the former, so the permission requirements for one of these two requests looks incorrect. I believe /katello/api/capsules/<capsule_id> should not require the admin flag.

Version-Release number of selected component (if applicable):
Satellite 6.10 and earlier (tested on 6.9 and 6.8).

How reproducible:
100%

Steps to Reproduce:
1. Create a user on Satellite, give it all permissions but not the admin flag.
2. Have an external capsule. In this example the external capsule ID is 2.
3. Query the API from Satellite itself at 2 points with the non-admin user:
curl -k -u theuser:password https://localhost/katello/api/capsules/2
and
curl -k -u theuser:password https://localhost/katello/api/capsules/

Actual results:

The first curl command fails with:

{
"error": {"message":"Resource smart_proxy not found by id '2'"}
}

The second command succeeds and returns all information about all capsules including capsule ID 2.

Expected results:

Both commands would succeed.

Additional info:

Location is not the issue here. These tests were performed on the lab and the user and capsule locations were made to match, or to differ. Location (mis)matching made no difference to the test outcomes, only the admin flag did.

Actions #1

Updated by The Foreman Bot 10 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/Katello/katello/pull/10722 added
Actions #2

Updated by Chris Roberts 10 months ago

  • Subject changed from Non-admin user cannot list an individual capsule but can list all capsules to Non-admin user cannot list an individual capsule but can list all capsules
  • Assignee set to Quinn James
  • Target version set to Katello 4.11.0
  • Triaged changed from No to Yes
Actions #3

Updated by The Foreman Bot 9 months ago

  • Fixed in Releases Katello 4.11.0 added
Actions #4

Updated by Anonymous 9 months ago

  • Status changed from Ready For Testing to Closed
Actions #5

Updated by Ian Ballou 7 months ago

  • Subject changed from Non-admin user cannot list an individual capsule but can list all capsules to Non-admin user cannot list an individual capsule but can list all smart proxies
Actions #6

Updated by Ian Ballou 7 months ago

  • Subject changed from Non-admin user cannot list an individual capsule but can list all smart proxies to Non-admin user cannot list an individual smart proxy but can list all smart proxies
Actions

Also available in: Atom PDF