-
Bug
-
Resolution: Done
-
Critical
-
None
-
None
-
False
-
False
-
None
-
HAC Infra OCM - Sprint 239, HAC Infra OCM - Sprint 240
Description of problem:
An org member user has granted with role permission "Identity provider editor" for a cluster. But in org member login session, the UI options to add or configure a new identity provider for the cluster is disabled. It looks like a wrong behavior.
CLI Role binding definition after granting role as below
ocm get /api/accounts_mgmt/v1/subscriptions/2RSLSuDSL9WpjOCtnI3PeFDgK2x/role_bindings
{
"items": [
{
"account": {
"href": "/api/accounts_mgmt/v1/accounts/1TBa2A3mL0wcoYHlBgt0xTxfJNA",
"id": "1TBa2A3mL0wcoYHlBgt0xTxfJNA",
"kind": "Account"
},
"account_email": "",
"account_username": "",
"created_at": "2023-06-20T07:38:53.179865Z",
"href": "/api/accounts_mgmt/v1/subscriptions/2RSLSuDSL9WpjOCtnI3PeFDgK2x/role_bindings/2RSc4gfOiwpGwc6v2sR4aisXGiJ",
"id": "2RSc4gfOiwpGwc6v2sR4aisXGiJ",
"kind": "RoleBinding",
"role": {
"href": "/api/accounts_mgmt/v1/roles/IdpEditor",
"id": "IdpEditor",
"kind": "Role"
},
"subscription": {
"href": "/api/accounts_mgmt/v1/subscriptions/2RSLSuDSL9WpjOCtnI3PeFDgK2x",
"id": "2RSLSuDSL9WpjOCtnI3PeFDgK2x",
"kind": "Subscription"
},
"updated_at": "2023-06-20T07:38:53.179865Z"
}
],
"kind": "SubscriptionRoleBindingList",
"page": 1,
"size": 1,
"total": 1
}
How reproducible:
Always
Steps to reproduce:
- Launch OCM UI staging and login as org-admin user.
- Open a ROSA hypershift cluster.
- Go to access control tab > OCM roles and access , click "Grant" button.
- Input Redhat login with a valid user name (ex: use a org-member user)
- Select Role as Identity provider editor and Click on "Grant role".
- Login to OCM UI Staging with the user granted permission in step 4 .
- Select and Open the cluster(same as step 2).
- Go to "Access control" tab > "Identity provider "and try to add the new IDP.
- Go to "Access control" tab> "OCM Roles and access" and try to grant a role.
Actual results:
The Access control section restricted to the user from adding new IDP or granting roles etc although user has granted with the role "Identity provider editor".
Expected results:
The Access control section should not restrict the user from adding new IDP or granting roles etc when user granted with the role "Identity provider editor".
- relates to
-
HAC-4273 [ROSA Hypershift] "OIDC and operator roles" cluster installation step is waiting state when no operator roles created prior to installation.
-
- Closed
-
- mentioned on