Icingaweb2: Monitoring action permissions should be linked to the object filter of the role they're originating from

[icinga-migration]

This issue has been migrated from Redmine: https://dev.icinga.com/issues/11943

Created by gvde on 2016-06-15 05:46:00 +00:00

Assignee: _(none)_
Status: _New_ (closed on _2016-10-04 09:32:24 +00:00_)
Target Version: _Backlog_
Last Update: _2016-10-31 12:46:56 +00:00 (in Redmine)_

---

If a user has two or more roles assigned it seems icingaweb2 "merges" all the permissions and restrictions of those role for the user. However, this is not what is usually expected when you use role-based mechanisms.

Roles should not merge. A user can operate as any role but not with mixed permissions from various roles.

For instance, if there are two roles:

[view-only]
permissions = "module/doc, module/monitoring"
users = "testuser"
monitoring/filter/objects = "*" 

[dev-admin]
permissions = "monitoring/command/acknowledge-problem, monitoring/command/remove-acknowledgement, monitoring/command/comment/*, monitoring/command/downtime/*, monitoring/command/send-custom-notification"
users = "testuser"
monitoring/filter/objects = "host_name=dev*"

view-only allows "read-only" access to all hosts and services.

dev-admin allows more permissions and all hosts named dev*.

Currently, icingaweb2 now "merges" these two roles for "testuser". This results in the user to have all the permissions given for dev-admin and to use them on all objects because of view-only.

If you comment out the monitoring/filter/objects = "*" from view-only, testuser is only to see hosts named "dev*" and no others anymore.

I think this is something completely different from what you would expect from "roles" access control. I would expect testuser to be able to use each distinct role he has but not merge something. Roles don't merge. That only leads to very unexpected results.

[icinga-migration]

Updated by elippmann on 2016-10-04 09:32:24 +00:00

• Tracker changed from _Feature_ to _Support_
• Status changed from _New_ to _Closed_

Remove monitoring/filter/objects = "*" from your view only role and you're fine.

[icinga-migration]

Updated by gvde on 2016-10-04 09:38:14 +00:00

No. It's not fine. As I wrote before:

If you comment out the monitoring/filter/objects = "" from view-only, testuser is only to see hosts named "dev" and no others anymore.

You can't see any of the other hosts anymore even though role view-only should allow me to...

[icinga-migration]

Updated by gvde on 2016-10-04 09:51:56 +00:00

Well, either I don't see it how to do it or I cannot reopen this issue.

It has been closed with a suggestion for which I already wrote that it does not what is expected...

Thus I will have to open a new issue for this...

[icinga-migration]

Updated by elippmann on 2016-10-04 10:06:20 +00:00

• Status changed from _Closed_ to _New_

Reopened for discussion. I'll get back to you shortly.

[icinga-migration]

Updated by gvde on 2016-10-31 11:29:23 +00:00

elippmann wrote:

Reopened for discussion. I'll get back to you shortly.

Anything I can do to clarify this?

[icinga-migration]

Updated by jmeyer on 2016-10-31 12:46:56 +00:00

• Tracker changed from _Support_ to _Bug_
• Subject changed from _Implement "real" roles_ to _Monitoring action permissions are not linked to the object filter of the role they're originating from_
• Target Version set to _Backlog_

Hi,

I don't think so. We should definitely change this so that the permissions a role declares may only effective for objects (or generally speaking, filtered items) which are not restricted by the very same role.
In this case "dev-admin" should only allow to perform monitoring actions on all hosts matched by the given filter.

Anyway, I can't tell you when we'll change this, whatever the final solution might be as it will definitely represent a major change in how roles are processed.

Best regards,
Johannes

[vita2]

if a user inherits multiple roles i also would prefer a separation between the permissions of this roles.

i want a role for my users which includes permissions to see all hosts and services (readonly, no permissions for actions or commands). some users should have higher permissions just for certain hostgroups to perform some actions like to acknowledge incidents or to set up downtimes. in current state it isn't possible because the permissions of all roles which a user owns will be merged.

i don't know how to configure the roles for my situation and have started a thread in monitoring-portal.org-board -> https://monitoring-portal.org/index.php?thread/39737-verhalten-von-berechtigungen-bei-der-zuweisung-von-mehreren-rollen/

[xenuser]

For me, it just feels wrong that you can apply only one set of flters on all selected permission sets. I think the permission system would be improved if one could pair filters with one permission set within a role. Or in other words: It should be possible for a role to contain multiple pairs of permission sets (e.g. monitoring module) and filters. This would prevent filters to relate to all selected permission sets.

[lflis]

Dear All,
Are there any news regarding that issue?

[cite]

@dnsmichi Any news on this?

[cite]

Any news on this?

[cite]

Any new developments here?

[tik-stbuehler]

I'd also like to point out that if there is role a defining only permissions and role b defining filters, a user having only role a sees more than a user having role a and role b. And a user having no role at all sees more than a user having role 'b'. That is seriously fucked up; having more roles should give you more, not less.

That means I now have to define a "match-all-users" role (and update to debian testing for that), which uses a filter that doesn't match anything (any suggestions for that?).