questions about (proposed changes for) role--group authz
Joseph Marques
jmarques at redhat.com
Mon Nov 15 20:24:00 UTC 2010
See questions below...
On 11/15/2010 03:02 PM, ips wrote:
> modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/roles/RolesDataSource.java | 23 +++++++---
> modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java | 2
> 2 files changed, 18 insertions(+), 7 deletions(-)
>
> New commits:
> commit 9315519acb694b4147a598f5258c5ffb95b7ce2e
> Author: Ian Springer<ian.springer at redhat.com>
> Date: Mon Nov 15 15:01:58 2010 -0500
>
> don't attempt to fetch subjects or resourceGroups for a Role unless the logged-in user has MANAGE_SECURITY
>
> modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/roles/RolesDataSource.java
>
> @Override
> @@ -99,6 +108,7 @@ public class RolesDataSource extends RPCDataSource<Role> {
> ...
> - criteria.fetchResourceGroups(true);
> criteria.fetchPermissions(true);
> - criteria.fetchSubjects(true);
> - // TODO: Uncomment this.
> - //criteria.fetchLdapGroups(true);
> +
> + if (this.globalPermissions.contains(Permission.MANAGE_SECURITY)) {
> + criteria.fetchSubjects(true);
> + criteria.fetchResourceGroups(true);
> + }
Fetching subjects should indeed be hidden behind MANAGE_SECURITY, but
should we allow a user with MANAGE_INVENTORY to be able to fetch the
corresponding groups for that role?
Looking further into this, I notice the same in RoleCriteria, where if
either of those fetches are specified then the user requires
MANAGE_SECURITY. Should the implementation instead be?
class RoleCriteria {
isSecurityManagerRequired() {
return this.fetchSubjects;
}
isInventoryManagerRequired() {
return this.fetchResourcesGroups;
}
}
>
> return criteria;
> }
> diff --git a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
> index adc834b..857ea0c 100644
> --- a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
> +++ b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
> @@ -126,7 +126,7 @@ public class UserEditView extends AbstractRecordEditor<UsersDataSource> {
> //
> private boolean areRolesReadOnly(Record record) {
> boolean isLdap = Boolean.valueOf(record.getAttribute(UsersDataSource.Field.LDAP));
> - return (!hasManageSecurityPermission || (getRecordId() == SUBJECT_ID_RHQADMIN) || isLdap);
> + return (!hasManageSecurityPermission || (getRecordId() == SUBJECT_ID_RHQADMIN) || isLdap);
I agree that editing the subjects and/or permissions for that role
should be constrained to those with MANAGE_SECURITY, but should a user
with MANAGE_INVENTORY be able to edit the resource groups associated
with the role?
More information about the rhq-devel
mailing list