LDAP users with similar permissions do not see each other's networks

[PPisz]

ISSUE TYPE

• Bug Report
• Improvement Request

COMPONENT NAME

LDAP, Network, UI

CLOUDSTACK VERSION

4.12

CONFIGURATION

Advanced networking with network service offering

OS / ENVIRONMENT

CentOS 7

SUMMARY

In one domain (eg. ROOT):
Admin create network offering
LDAP root admin user create network with network offering
Another LDAP root admin user not see this network

STEPS TO REPRODUCE

Create two LDAP users with root admin permissions and create networks.

EXPECTED RESULTS

All users in one domain with root admin privileges have the same capabilities (in this case, they can create a VM with a network created by another user).

ACTUAL RESULTS

LDAP user with root admin privileges can not see the networks created by the standard admin user (on the same domain). If such a user (ldap) with root admin privileges creates a new network, it is not visible to other users in UI
I consider this to be an error which makes work with users with root admin privileges very difficult

[andrijapanicsb]

Heard a similar thing from another user.
"LDAP-authenticated" ADMIN vs. "local-authenticated" ADMIN - can't see each other's networks.

[PaulAngus]

Are these the same root admin account or two accounts which both have root admin privileges?

[PPisz]

Two accounts with root admin privileges:

ppisz | Root Admin | Admin | ROOT | enabled
tome | Root Admin | Admin | ROOT | enabled

[PaulAngus]

Is the other network visible through the API (when you use listall=true) ?
and can the 'Real' root admin account see them?

[PPisz]

LDAP root admin sees all networks through the API (not in UI).
Real admin see all networks in UI.

[DaanHoogland]

as the real admin is the one and there an be only one, i would expect this behaviour. No idea if this is true but i wouldn't expect a second 'local' root user to see all networks in the UI either. (#testingneeded)

[andrijapanicsb]

root admin is a root admin, irrelevant how he was authenticated (IMO) - so both root admins should see everything...

[DaanHoogland]

should, maybe, not going into that. works that way is my question, i.e. is this behaviour ldap specific? sounds a bit weird knowing the implementation but worth finding out.

[PPisz]

This is the specifics of CloudStack UI, not ldap. We tested it on an external CloudStack-UI and everything works as expected (via API). Unfortunately, CloudStack-UI is intended for ordinary users, not for administrators. Primate is not ready for production use. Please fix this error :-)

[DaanHoogland]

the js isAdmin() only returns true for admin never for another root-admin. please amend if you feel this should change @PPisz .