Make user filter as restriction in RBAC #15367
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This pull request is not mergeable. Please rebase and repush. |
lpichler
force-pushed
the
make_user_filter_as_restriction
branch
from
71b12d2
to
a5fe841
Compare
lpichler
changed the title
|
@miq-bot remove_label wip |
|
Checked commits lpichler/manageiq@d5c7e13~...a5fe841 with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0 |
kbrock
added a commit
that referenced
this pull request
Apr 20, 2018
…striction Revert "Merge pull request #15367"
simaishi
pushed a commit
that referenced
this pull request
Apr 20, 2018
…striction Revert "Merge pull request #15367" (cherry picked from commit 9f8c439) Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1570118
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WIP: this PR is based on #15346,
last 4 commits are related to this PR
Some facts 📝
we have method
combine_filtered_idsin RBAC and there is combination logic of different filter ids:u_filtered_ids- this ids of resource are based set ownership of resource and option in user rolecalled "Only User or Group Owned" and "Only User Owned"
b_filtered_ids- belongs to filter ids are from filter calledHost & Cluster(tab in group)m_filtered_ids- managed filter ids are form tag filer (tab in group)d_filtered_ids- these are based on any descendant relation. (example: #15271 ManageIQ/manageiq-ui-classic#1474 )we want to filter CloudNetwork instances according to the relation of extmanagement system
tenant_filter_ids- this additional tenant filter for rbac through association, it used for classes like aMetricRollup, Metricwhere want to do rbac thru his polymorphic resourceAlgorithm before
this filtered ids are combined by algorithm:
As you can see user filter (u_filtered_ids) is not doing restriction of descedant filter and of belongs/managed filter.
Algorithm after
So we have to restrict whole result according to user filter (u_filtered_ids) :
Real case
User has enabled filtering acccording tag
tag1and also he self service user(option Only User or Group Owned)also three vms:
vm1 - no tag, group ownership set to User's group
vm2- tagged by
tag1, ownership is not setvm3 -tagged by
tag1,group ownership set to User's groupresult before
vm1, vm2 and vm3
result after
vm3 (only) - because only this vm has tag1 and ownership set to vm2
Links
https://bugzilla.redhat.com/show_bug.cgi?id=1451266
https://bugzilla.redhat.com/show_bug.cgi?id=1450839
@miq-bot assign @gtanzillo
@miq-bot add_label rbac, bug