{"action":"created","issue":{"url":"https://api.github.com/repos/ManageIQ/manageiq/issues/13535","repository_url":"https://api.github.com/repos/ManageIQ/manageiq","labels_url":"https://api.github.com/repos/ManageIQ/manageiq/issues/13535/labels{/name}","comments_url":"https://api.github.com/repos/ManageIQ/manageiq/issues/13535/comments","events_url":"https://api.github.com/repos/ManageIQ/manageiq/issues/13535/events","html_url":"https://github.com/ManageIQ/manageiq/pull/13535","id":201189594,"number":13535,"title":"Introduces CloudTenancyMixin to fix RBAC for cloud_tenant based models","user":{"login":"rwsu","id":974403,"avatar_url":"https://avatars2.githubusercontent.com/u/974403?v=3","gravatar_id":"","url":"https://api.github.com/users/rwsu","html_url":"https://github.com/rwsu","followers_url":"https://api.github.com/users/rwsu/followers","following_url":"https://api.github.com/users/rwsu/following{/other_user}","gists_url":"https://api.github.com/users/rwsu/gists{/gist_id}","starred_url":"https://api.github.com/users/rwsu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwsu/subscriptions","organizations_url":"https://api.github.com/users/rwsu/orgs","repos_url":"https://api.github.com/users/rwsu/repos","events_url":"https://api.github.com/users/rwsu/events{/privacy}","received_events_url":"https://api.github.com/users/rwsu/received_events","type":"User","site_admin":false},"labels":[{"id":106615678,"url":"https://api.github.com/repos/ManageIQ/manageiq/labels/enhancement","name":"enhancement","color":"84b6eb","default":true},{"id":297146491,"url":"https://api.github.com/repos/ManageIQ/manageiq/labels/rbac","name":"rbac","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":{"login":"gtanzillo","id":76593,"avatar_url":"https://avatars0.githubusercontent.com/u/76593?v=3","gravatar_id":"","url":"https://api.github.com/users/gtanzillo","html_url":"https://github.com/gtanzillo","followers_url":"https://api.github.com/users/gtanzillo/followers","following_url":"https://api.github.com/users/gtanzillo/following{/other_user}","gists_url":"https://api.github.com/users/gtanzillo/gists{/gist_id}","starred_url":"https://api.github.com/users/gtanzillo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gtanzillo/subscriptions","organizations_url":"https://api.github.com/users/gtanzillo/orgs","repos_url":"https://api.github.com/users/gtanzillo/repos","events_url":"https://api.github.com/users/gtanzillo/events{/privacy}","received_events_url":"https://api.github.com/users/gtanzillo/received_events","type":"User","site_admin":false},"assignees":[{"login":"gtanzillo","id":76593,"avatar_url":"https://avatars0.githubusercontent.com/u/76593?v=3","gravatar_id":"","url":"https://api.github.com/users/gtanzillo","html_url":"https://github.com/gtanzillo","followers_url":"https://api.github.com/users/gtanzillo/followers","following_url":"https://api.github.com/users/gtanzillo/following{/other_user}","gists_url":"https://api.github.com/users/gtanzillo/gists{/gist_id}","starred_url":"https://api.github.com/users/gtanzillo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gtanzillo/subscriptions","organizations_url":"https://api.github.com/users/gtanzillo/orgs","repos_url":"https://api.github.com/users/gtanzillo/repos","events_url":"https://api.github.com/users/gtanzillo/events{/privacy}","received_events_url":"https://api.github.com/users/gtanzillo/received_events","type":"User","site_admin":false}],"milestone":null,"comments":9,"created_at":"2017-01-17T06:48:33Z","updated_at":"2017-03-17T05:32:30Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ManageIQ/manageiq/pulls/13535","html_url":"https://github.com/ManageIQ/manageiq/pull/13535","diff_url":"https://github.com/ManageIQ/manageiq/pull/13535.diff","patch_url":"https://github.com/ManageIQ/manageiq/pull/13535.patch"},"body":"RBAC is broken for models based on cloud_tenant instead of tenant.\r\nCurrently a cloud tenant user can see all cloud_tenant based\r\nobjects. This patches introduces a CloudTenancyMixin that a\r\ncloud_tenant model can include for RBAC to work correctly.\r\n\r\nCloudTenancyMixin is similar to TenancyMixin in that it defines\r\nmethods used by Rbac.Filterer.scope_targets to filter results\r\nso that users only sees objects that belong to their tenant\r\ngroups.\r\n\r\nCloudVolume now includes CloudTenancyMixin which fixes issue\r\n\r\nAdditional models using cloud_tenant will be updated in subsequent\r\npatches.\r\n\r\nFixes \r\n----------------\r\n\r\n* https://github.com/ManageIQ/manageiq/issues/13343#issuecomment-270410029\r\n\r\nSteps for Testing/QA [Optional]\r\n-------------------------------\r\n\r\nIn OpenStack Dashboard,\r\n* create two projects, project1 and project2, add the admin user as a admin to both projects (otherwise you won't be able to setup the groups users in ManageIQ as the admin user)\r\n* create one volume in project1\r\n* create one volume in project2\r\n\r\nVerify you have Tenant Mapping Enabled set to True for your OpenStack Cloud Provider. If not recreate it.\r\n\r\nUnder Configuration > Access Control > Groups\r\n* create an admin group for project/tenant project1 and has role EvmRole-super_administrator\r\n* create an admin group for project/tenant project2 and has role EvmRole-super_administrator\r\n\r\nUnder Configuration > Access Control > Users\r\n* create a user project1-admin who belongs to project1 admin group and has EvmRole-super_administrator role\r\n* create a user project2-admin who belongs to project2 admin group and has EvmRole-super_administrator role\r\n\r\nLogin as project1-admin, navigate to Storage > Block Storage > Volumes, and verify you only see volumes belonging to project1\r\nLogin as project2-admin, navigate to Storage > Block Storage > Volumes, and verify you only see volumes belonging to project2\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/ManageIQ/manageiq/issues/comments/287270929","html_url":"https://github.com/ManageIQ/manageiq/pull/13535#issuecomment-287270929","issue_url":"https://api.github.com/repos/ManageIQ/manageiq/issues/13535","id":287270929,"user":{"login":"miq-bot","id":7806257,"avatar_url":"https://avatars2.githubusercontent.com/u/7806257?v=3","gravatar_id":"","url":"https://api.github.com/users/miq-bot","html_url":"https://github.com/miq-bot","followers_url":"https://api.github.com/users/miq-bot/followers","following_url":"https://api.github.com/users/miq-bot/following{/other_user}","gists_url":"https://api.github.com/users/miq-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/miq-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miq-bot/subscriptions","organizations_url":"https://api.github.com/users/miq-bot/orgs","repos_url":"https://api.github.com/users/miq-bot/repos","events_url":"https://api.github.com/users/miq-bot/events{/privacy}","received_events_url":"https://api.github.com/users/miq-bot/received_events","type":"User","site_admin":false},"created_at":"2017-03-17T05:32:30Z","updated_at":"2017-03-17T05:32:30Z","body":"<rubocop />Checked commits https://github.com/rwsu/manageiq/compare/fc32e7ec3597484bd9a4e01bc4c99d69db0706f2~...33a3327b395700ce245f9f770b4277e0ce08d2c2 with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0\n8 files checked, 1 offense detected\n\n**app/models/manageiq/providers/openstack/cloud_manager.rb**\n- [ ] :exclamation: - [Line 72](https://github.com/rwsu/manageiq/blob/33a3327b395700ce245f9f770b4277e0ce08d2c2/app/models/manageiq/providers/openstack/cloud_manager.rb#L72), Col 22 - [Rails/SkipsModelValidations](http://rubydoc.info/gems/rubocop/0.47.1/RuboCop/Cop/Rails/SkipsModelValidations) - Avoid using `update_all` because it skips validations.\n"}}
{"actor":{"display_login":"miq-bot"}}