Uploaded image for project: 'FlightPath'
  1. FlightPath
  2. FLPATH-2261

workflowAdminView does not seem to change anything

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • 1.5.0
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • Important

      Description of the problem:

      I've created an rbac role utilizing workflowAdminView similar to this example and it seems to make no difference compared to various other lesser roles. From what I can tell other lesser roles should be limited from seeing the workflow definition / variables screen, but they still can. 

      Versions: 

      How reproducible: 100%

      Steps to reproduce:

      1. Deploy orchestrator 1.5 with rbac enabled

      2. Use policy.yaml file for rbac authorization configuration

      3. Create the following 

          # admin role and user
          p, role:default/workflowAdmin, orchestrator.workflow, read, allow
          p, role:default/workflowAdmin, orchestrator.workflow.use, update, allow
          p, role:default/workflowAdmin, orchestrator.workflowAdminView, read, allow
          g, user:default/test-admin-user, role:default/workflowAdmin
          
          # regular role and user
          p, role:default/workflowReadwrite, orchestrator.workflow, read, allow
          p, role:default/workflowReadwrite, orchestrator.workflow.use, update, allow
          g, user:default/test-regular-user, role:default/workflowReadwrite

      4. Run work flow and view results / variables / workflow definition and compare between users

      Actual results:

      Both users can view everything exactly the same 

      Expected results:

      There is some difference between what the users can view

              rh-ee-lsoffer Lior Soffer
              chadcrum Chad Crum
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: