Hi,

I have been playing around with RBAC and I have the following issue (on 3.2.5 
version).

1.      First I made a simple test: enabled RBAC, gave Member role *.* CRUD 
rights. Logged in as a Member user in the GUI and I am able to create a very 
basic virtual-network (just type in a name and press create). All is working 
fine, the network is created without any error.

2.      A more complex test will fail: Instead of adding *.* CRUD for member, I 
have tried a more specific set of rights:

[root@contrail lib]# python /opt/contrail/utils/rbacutil.py --op read
AAA mode is rbac

Oper       =  read
Name       = ['default-global-system-config', 'default-api-access-list']
UUID       = None
API Server =  127.0.0.1:8082

Rules (10):
----------
1 fqname-to-id                       *:CRUD,
2 id-to-fqname                       *:CRUD,
3 useragent-kv                       *:CRUD,
4 documentation                      *:R,
5 /.*                                *:R,
6 *.*                                Member:R,
7 /                                  *:R,
8 *.*                                Member:R,     <<< Read for all objects
9 virtual-networks.*                 Member:CRUD,  <<< CRUD for nrtworks
10 network-ipams.*                    Member:CRUD,  <<< CRUD for ipams (guess 
needed for networks)

With these rights, logging in the GUI as a Member user, if I try to create a 
simple virtual-network I will get the error: Permission Denied.



I suspected that some more rights are needed, but I added all of the existing 
objects from the drop down list as <object>.* CRUD (more than 50 items). And 
still the same error appeared.

Also, I check the contrail-api.log and all the RBAC related logs show +++ 
(check successful).



Please advise if this is a known issue on 3.2.5 or not.



Thanks
_______________________________________________
Dev mailing list
[email protected]
http://lists.opencontrail.org/mailman/listinfo/dev_lists.opencontrail.org

Reply via email to