Hi, I have been playing around with RBAC and I have the following issue (on 3.2.5 version).
1. First I made a simple test: enabled RBAC, gave Member role *.* CRUD rights. Logged in as a Member user in the GUI and I am able to create a very basic virtual-network (just type in a name and press create). All is working fine, the network is created without any error. 2. A more complex test will fail: Instead of adding *.* CRUD for member, I have tried a more specific set of rights: [root@contrail lib]# python /opt/contrail/utils/rbacutil.py --op read AAA mode is rbac Oper = read Name = ['default-global-system-config', 'default-api-access-list'] UUID = None API Server = 127.0.0.1:8082 Rules (10): ---------- 1 fqname-to-id *:CRUD, 2 id-to-fqname *:CRUD, 3 useragent-kv *:CRUD, 4 documentation *:R, 5 /.* *:R, 6 *.* Member:R, 7 / *:R, 8 *.* Member:R, <<< Read for all objects 9 virtual-networks.* Member:CRUD, <<< CRUD for nrtworks 10 network-ipams.* Member:CRUD, <<< CRUD for ipams (guess needed for networks) With these rights, logging in the GUI as a Member user, if I try to create a simple virtual-network I will get the error: Permission Denied. I suspected that some more rights are needed, but I added all of the existing objects from the drop down list as <object>.* CRUD (more than 50 items). And still the same error appeared. Also, I check the contrail-api.log and all the RBAC related logs show +++ (check successful). Please advise if this is a known issue on 3.2.5 or not. Thanks
_______________________________________________ Dev mailing list [email protected] http://lists.opencontrail.org/mailman/listinfo/dev_lists.opencontrail.org
