Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-63247

[release-4.18] Normal user without project could only see parts of roles list.

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Moderate
    • None
    • None
    • None
    • None
    • In Progress
    • Bug Fix
    • Hide
      * Before this update, users without a project saw only part of the *Roles* list because of insufficient role-based access control (RBAC) permissions. With this release, the access logic is fixed. As a result, these users cannot open the *Roles* page, which keeps sensitive data secure. (link:https://issues.redhat.com/browse/OCPBUGS-63247[OCPBUGS-63247])
      Show
      * Before this update, users without a project saw only part of the *Roles* list because of insufficient role-based access control (RBAC) permissions. With this release, the access logic is fixed. As a result, these users cannot open the *Roles* page, which keeps sensitive data secure. (link: https://issues.redhat.com/browse/OCPBUGS-63247 [ OCPBUGS-63247 ])
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-56987. The following is the description of the original issue:
      —
      This is a clone of issue OCPBUGS-56707. The following is the description of the original issue:
      —
      Description of problem:

      A normal user without project accessed 'User management'->'Roles' page, could only see parts of roles list.

      Version-Release number of selected component (if applicable):

          4.19.0-0.nightly-2025-05-26-074247

      How reproducible:

      Always

      Steps to Reproduce:

          1.A normal user without project accessed 'User management'->'Roles' page.
    2.
    3.

      Actual results:

      1. User could only see parts of roles list and could not scroll down the page.

      Expected results:

      1. For user without project, seems no roles should be shown. See output from client:
[yanpzhan@fedora ~]$ oc get roles.rbac.authorization.k8s.io --all-namespaces
Error from server (Forbidden): roles.rbac.authorization.k8s.io is forbidden: User "testuser-31" cannot list resource "roles" in API group "rbac.authorization.k8s.io" at the cluster scope
[yanpzhan@fedora ~]$ oc get roles.authorization.openshift.io --all-namespaces
Error from server (Forbidden): roles.authorization.openshift.io is forbidden: User "testuser-31" cannot list resource "roles" in API group "authorization.openshift.io" at the cluster scope

      Additional info:

              rhn-engineering-rhamilto Robb Hamilton
              openshift-crt-jira-prow OpenShift Prow Bot
              None
              None
              Yanping Zhang Yanping Zhang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: