questions about (proposed changes for) role--group authz

Joseph Marques jmarques at redhat.com
Mon Nov 15 20:24:00 UTC 2010


See questions below...

On 11/15/2010 03:02 PM, ips wrote:
>   modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/roles/RolesDataSource.java |   23 +++++++---
>   modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java    |    2
>   2 files changed, 18 insertions(+), 7 deletions(-)
>
> New commits:
> commit 9315519acb694b4147a598f5258c5ffb95b7ce2e
> Author: Ian Springer<ian.springer at redhat.com>
> Date:   Mon Nov 15 15:01:58 2010 -0500
>
>      don't attempt to fetch subjects or resourceGroups for a Role unless the logged-in user has MANAGE_SECURITY
>
> modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/roles/RolesDataSource.java
>
>       @Override
> @@ -99,6 +108,7 @@ public class RolesDataSource extends RPCDataSource<Role>  {
> ...
> -        criteria.fetchResourceGroups(true);
>           criteria.fetchPermissions(true);
> -        criteria.fetchSubjects(true);
> -        // TODO: Uncomment this.
> -        //criteria.fetchLdapGroups(true);
> +
> +        if (this.globalPermissions.contains(Permission.MANAGE_SECURITY)) {
> +            criteria.fetchSubjects(true);
> +            criteria.fetchResourceGroups(true);
> +        }

Fetching subjects should indeed be hidden behind MANAGE_SECURITY, but 
should we allow a user with MANAGE_INVENTORY to be able to fetch the 
corresponding groups for that role?

Looking further into this, I notice the same in RoleCriteria, where if 
either of those fetches are specified then the user requires 
MANAGE_SECURITY.  Should the implementation instead be?

class RoleCriteria {
     isSecurityManagerRequired() {
         return this.fetchSubjects;
     }
     isInventoryManagerRequired() {
         return this.fetchResourcesGroups;
     }
}

>
>           return criteria;
>       }
> diff --git a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
> index adc834b..857ea0c 100644
> --- a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
> +++ b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
> @@ -126,7 +126,7 @@ public class UserEditView extends AbstractRecordEditor<UsersDataSource>  {
>       //
>       private boolean areRolesReadOnly(Record record) {
>           boolean isLdap = Boolean.valueOf(record.getAttribute(UsersDataSource.Field.LDAP));
> -        return (!hasManageSecurityPermission || (getRecordId() == SUBJECT_ID_RHQADMIN) || isLdap);
> +        return (!hasManageSecurityPermission || (getRecordId() == SUBJECT_ID_RHQADMIN) || isLdap);

I agree that editing the subjects and/or permissions for that role 
should be constrained to those with MANAGE_SECURITY, but should a user 
with MANAGE_INVENTORY be able to edit the resource groups associated 
with the role?


More information about the rhq-devel mailing list