Skip to content

Allow domain admin to change domain and account settings #4339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nvazquez merged 9 commits into from
Feb 21, 2022
Merged

Allow domain admin to change domain and account settings #4339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
679cb20
Allow domain admin to change domain and account settings
davidjumani Jun 22, 2021
b1e081f
Merge branch 'main' of github.com:apache/cloudstack into allow-domadm…
davidjumani Sep 21, 2021
a413b9d
Cleanup
davidjumani Sep 21, 2021
5c6075c
Remove useless global setting
davidjumani Sep 21, 2021
3cef3d5
Restrict regular users with listConfig access
davidjumani Sep 29, 2021
d3a574d
Address comments
davidjumani Sep 30, 2021
854980d
Merge branch 'main' of github.com:apache/cloudstack into allow-domadm…
davidjumani Feb 8, 2022
630d98f
Merge branch 'main' of github.com:apache/cloudstack into allow-domadm…
davidjumani Feb 15, 2022
6bbbcc3
Moving upgrade path
davidjumani Feb 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions engine/schema/src/main/resources/META-INF/db/schema-41520to41600.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -741,26 +741,26 @@ CREATE PROCEDURE `cloud`.`ADD_GUEST_OS_AND_HYPERVISOR_MAPPING` (
IN guest_os_hypervisor_hypervisor_version VARCHAR(32),
IN guest_os_hypervisor_guest_os_name VARCHAR(255)
)
BEGIN
INSERT INTO cloud.guest_os (uuid, category_id, display_name, created)
BEGIN
INSERT INTO cloud.guest_os (uuid, category_id, display_name, created)
SELECT UUID(), guest_os_category_id, guest_os_display_name, now()
FROM DUAL
WHERE not exists( SELECT 1
WHERE not exists( SELECT 1
FROM cloud.guest_os
WHERE cloud.guest_os.category_id = guest_os_category_id
AND cloud.guest_os.display_name = guest_os_display_name)
; INSERT INTO cloud.guest_os_hypervisor (uuid, hypervisor_type, hypervisor_version, guest_os_name, guest_os_id, created)
AND cloud.guest_os.display_name = guest_os_display_name)

; INSERT INTO cloud.guest_os_hypervisor (uuid, hypervisor_type, hypervisor_version, guest_os_name, guest_os_id, created)
SELECT UUID(), guest_os_hypervisor_hypervisor_type, guest_os_hypervisor_hypervisor_version, guest_os_hypervisor_guest_os_name, guest_os.id, now()
FROM cloud.guest_os
WHERE guest_os.category_id = guest_os_category_id
AND guest_os.display_name = guest_os_display_name
AND NOT EXISTS (SELECT 1
AND NOT EXISTS (SELECT 1
FROM cloud.guest_os_hypervisor as hypervisor
WHERE hypervisor_type = guest_os_hypervisor_hypervisor_type
WHERE hypervisor_type = guest_os_hypervisor_hypervisor_type
AND hypervisor_version = guest_os_hypervisor_hypervisor_version
AND hypervisor.guest_os_id = guest_os.id
AND hypervisor.guest_os_name = guest_os_hypervisor_guest_os_name)
AND hypervisor.guest_os_name = guest_os_hypervisor_guest_os_name)
;END;

-- PR#4699 Call procedure `ADD_GUEST_OS_AND_HYPERVISOR_MAPPING` to add new data to guest_os and guest_os_hypervisor.
Expand Down
3 changes: 3 additions & 0 deletions engine/schema/src/main/resources/META-INF/db/schema-41610to41700.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -643,3 +643,6 @@ CREATE VIEW `cloud`.`domain_router_view` AS
`cloud`.`async_job` ON async_job.instance_id = vm_instance.id
and async_job.instance_type = 'DomainRouter'
and async_job.job_status = 0;

INSERT INTO `cloud`.`role_permissions` (`uuid`, `role_id`, `rule`, `permission`, `sort_order`) SELECT UUID(), 3, 'listConfigurations', 'ALLOW', (SELECT MAX(`sort_order`)+1 FROM `cloud`.`role_permissions`) ON DUPLICATE KEY UPDATE rule=rule;
INSERT INTO `cloud`.`role_permissions` (`uuid`, `role_id`, `rule`, `permission`, `sort_order`) SELECT UUID(), 3, 'updateConfiguration', 'ALLOW', (SELECT MAX(`sort_order`)+1 FROM `cloud`.`role_permissions`) ON DUPLICATE KEY UPDATE rule=rule;
18 changes: 16 additions & 2 deletions server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -810,14 +810,25 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
final Long zoneId = cmd.getZoneId();
final Long clusterId = cmd.getClusterId();
final Long storagepoolId = cmd.getStoragepoolId();
final Long accountId = cmd.getAccountId();
final Long imageStoreId = cmd.getImageStoreId();
final Long domainId = cmd.getDomainId();
Long accountId = cmd.getAccountId();
Long domainId = cmd.getDomainId();
CallContext.current().setEventDetails(" Name: " + name + " New Value: " + (name.toLowerCase().contains("password") ? "*****" : value == null ? "" : value));
// check if config value exists
final ConfigurationVO config = _configDao.findByName(name);
String catergory = null;

final Account caller = CallContext.current().getCallingAccount();
if (_accountMgr.isDomainAdmin(caller.getId())) {
if (accountId == null && domainId == null) {
domainId = caller.getDomainId();
}
} else if (_accountMgr.isNormalUser(caller.getId())) {
if (accountId == null) {
accountId = caller.getAccountId();
}
}

// FIX ME - All configuration parameters are not moved from config.java to configKey
if (config == null) {
if (_configDepot.get(name) == null) {
Expand Down Expand Up @@ -848,11 +859,14 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
paramCountCheck++;
}
if (accountId != null) {
Account account = _accountMgr.getAccount(accountId);
_accountMgr.checkAccess(caller, null, false, account);
scope = ConfigKey.Scope.Account.toString();
id = accountId;
paramCountCheck++;
}
if (domainId != null) {
_accountMgr.checkAccess(caller, _domainDao.findById(domainId));
scope = ConfigKey.Scope.Domain.toString();
id = domainId;
paramCountCheck++;
Expand Down
18 changes: 16 additions & 2 deletions server/src/main/java/com/cloud/server/ManagementServerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2012,13 +2012,24 @@ public Pair<List<? extends Configuration>, Integer> searchForConfigurations(fina
final Long zoneId = cmd.getZoneId();
final Long clusterId = cmd.getClusterId();
final Long storagepoolId = cmd.getStoragepoolId();
final Long accountId = cmd.getAccountId();
final Long domainId = cmd.getDomainId();
final Long imageStoreId = cmd.getImageStoreId();
Long accountId = cmd.getAccountId();
Long domainId = cmd.getDomainId();
String scope = null;
Long id = null;
int paramCountCheck = 0;

final Account caller = CallContext.current().getCallingAccount();
if (_accountMgr.isDomainAdmin(caller.getId())) {
if (accountId == null && domainId == null) {
domainId = caller.getDomainId();
}
} else if (_accountMgr.isNormalUser(caller.getId())) {
if (accountId == null) {
accountId = caller.getAccountId();
}
}

if (zoneId != null) {
scope = ConfigKey.Scope.Zone.toString();
id = zoneId;
Expand All @@ -2030,11 +2041,14 @@ public Pair<List<? extends Configuration>, Integer> searchForConfigurations(fina
paramCountCheck++;
}
if (accountId != null) {
Account account = _accountMgr.getAccount(accountId);
_accountMgr.checkAccess(caller, null, false, account);
scope = ConfigKey.Scope.Account.toString();
id = accountId;
paramCountCheck++;
}
if (domainId != null) {
_accountMgr.checkAccess(caller, _domainDao.findById(domainId));
scope = ConfigKey.Scope.Domain.toString();
id = domainId;
paramCountCheck++;
Expand Down
4 changes: 3 additions & 1 deletion ui/src/config/section/account.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@
// specific language governing permissions and limitations
// under the License.

import store from '@/store'

export default {
name: 'account',
title: 'label.accounts',
Expand Down Expand Up @@ -49,7 +51,7 @@ export default {
{
name: 'settings',
component: () => import('@/components/view/SettingsTab.vue'),
show: (record, route, user) => { return ['Admin'].includes(user.roletype) }
show: () => { return 'listConfigurations' in store.getters.apis }
}
],
actions: [
Expand Down
2 changes: 1 addition & 1 deletion ui/src/config/section/config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ export default {
name: 'config',
title: 'label.configuration',
icon: 'setting',
permission: ['listConfigurations'],
permission: ['listConfigurations', 'listInfrastructure'],
Copy link
Copy Markdown
Contributor Author

@davidjumani davidjumani Sep 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding this so the global settings tab doesn't show to domain admins since they now have access to listConfigurations

children: [
{
name: 'globalsetting',
Expand Down
4 changes: 3 additions & 1 deletion ui/src/config/section/domain.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@
// specific language governing permissions and limitations
// under the License.

import store from '@/store'

export default {
name: 'domain',
title: 'label.domains',
Expand Down Expand Up @@ -53,7 +55,7 @@ export default {
{
name: 'settings',
component: () => import('@/components/view/SettingsTab.vue'),
show: (record, route, user) => { return ['Admin'].includes(user.roletype) }
show: () => { return 'listConfigurations' in store.getters.apis }
}, {
name: 'comments',
component: () => import('@/components/view/AnnotationsTab.vue')
Expand Down