Tenant admin can create a super admin

[evertmulder]

Steps to reproduce:

• Create child tenant: "My tenant"
• Create group with:
  • "My Tenant admin group" with role: "EvmRole-tenant_administrator"
  • Tenant: "My tenant"
• Create tenant admin user "tenantadmin" with group "My Tenant admin group"
• login as tenant admin
• I can now create a new user with the group "EvmRole-super_administrator"

This escalates the privileges of a tenant admin to global admin, defeating the tenant separation.

Tested both in darga and euwe

[evertmulder]

This issue should be moved to the classic-ui repo now.

The issue is in manageiq-ui-classic/app/controllers/ops_controller/ops_rbac.rb, line 988

 @edit[:groups] = MiqGroup.non_tenant_groups_in_my_region.sort_by { |g| g.description.downcase }.collect { |g| [g.description, g.id] }

should be

 @edit[:groups] = Rbac.filtered(MiqGroup.non_tenant_groups_in_my_region).sort_by { |g| g.description.downcase }.collect { |g| [g.description, g.id] }

and when saving the user the input should be checked again in rbac_user_validate?

I'll try a PR for this.

[martinpovolny]

Fixed via ManageIQ/manageiq-ui-classic#127

@evertmulder : thanks a lot!

[evertmulder]

Thanks for all the help!
There is still an issue where an Tenant admin can create a group with, role "super admin", and assign it to his own tenant, but this group is not selectable when creating users. I will open a issue in de classic-UI-repo for this.
Note. The API possible also has this issue. I will check this.

[martinpovolny]

@evertmulder : please, ping me in the issue that you create. I'd like to make sure we resolve this quick.

Thx!

[evertmulder]

@martinpovolny. every working is as expected using the API. The UI still has an issue: ManageIQ/manageiq-ui-classic#134 and ManageIQ/manageiq-ui-classic#135