Web UI always in self service mode no matter what role a user belongs to

[kwtygrys]

Hi

I am running Freeipa 4.5.4 on Centos 7 server. I created a few users hradmin, itadmin, secadmin and assigned them to the built-in special roles User Administrator, IT Specialist and IT Security Specialist respectively. However every time I try to access the Web UI as one of those users I always get the WebUI in self-service mode, ie. I can not take advantage of the privileges/permissions these users have. I only get the WebUI administration mode when logging in as admin.

Is there anything I am missing in terms of configuration?

Regards
Kristof

[Florence Blanc-Renaud]

On 9/21/18 2:06 PM, kwtygrys via FreeIPA-users wrote:
> Hi
>
> I am running Freeipa 4.5.4 on Centos 7 server. I created a few users hradmin, itadmin, secadmin and assigned them to the built-in special roles User Administrator, IT Specialist and IT Security Specialist respectively. However every time I try to access the Web UI as one of those users I always get the WebUI in self-service mode, ie. I can not take advantage of the privileges/permissions these users have. I only get the WebUI administration mode when logging in as admin.
>
> Is there anything I am missing in terms of configuration?

Hi,
IIRC a user has access to the whole WebUI administration when he is a 
member of the "admins" group.

flo
> Regards
> Kristof
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[kwtygrys]

well, according to the freeipa page https://www.freeipa.org/page/Web_UI https://www.freeipa.org/page/Web_UI

Web UI has two operation modes:

self-service
used for regular users
limited interface - only information about users
default page: user's profile
use cases: change or view own information and reset password
administration
used for members of 'admins' group and users with a role assigned
complete interface available

Whats the point of giving an individual "User Administrator" role if he/she can not provision users using the Web UI? And if you want to use the ipa user-* commands then you need to actually create a different user admin role that has a write permission to cn=users,cn=accounts as the built-in “User Administrator” doesn’t have it and thus the ipa user-* commands don’t work.

Is this a well known bug/limitation? How do you go about providing role assigned principals with means to act upon the privileges they posses?

Regards
Kristof
> On Sep 21, 2018, at 4:12 PM, Florence Blanc-Renaud  wrote:
>
> On 9/21/18 2:06 PM, kwtygrys via FreeIPA-users wrote:
> > Hi
> > I am running Freeipa 4.5.4 on Centos 7 server. I created a few users hradmin, itadmin, secadmin and assigned them to the built-in special roles User Administrator, IT Specialist and IT Security Specialist respectively. However every time I try to access the Web UI as one of those users I always get the WebUI in self-service mode, ie. I can not take advantage of the privileges/permissions these users have. I only get the WebUI administration mode when logging in as admin.
> > Is there anything I am missing in terms of configuration?
>
> Hi,
> IIRC a user has access to the whole WebUI administration when he is a member of the "admins" group.
>
> flo
> > Regards
> > Kristof
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Florence Blanc-Renaud]

On 9/21/18 5:25 PM, kwtygrys via FreeIPA-users wrote:
> well, according to the freeipa page https://www.freeipa.org/page/Web_UI
>
> Web UI has two operation modes:
> self-service
>   o used for regular users
>   o limited interface - only information about users
>   o default page: user's profile
>   o use cases: change or view own information and reset password
> administration
>   o *used for members of 'admins' group and users with a role assigned*
>   o complete interface available

Hi,
I stand corrected, if the user is assigned a role he should see the 
administration console. This is confirmed by the code (see [1]).

I tried on RHEL 7.5 (ipa 4.5.4) and see the expected behavior: a user 
with User Administrator, IT Specialist and IT Security Specialist roles 
is able to see the admin console, and create new users.
> Whats the point of giving an individual "User Administrator" role if 
> he/she can not provision users using the Web UI? And if you want to use 
> the ipa user-* commands then you need to actually create a different 
> user admin role that has a write permission to cn=users,cn=accounts as 
> the built-in “User Administrator” doesn’t have it and thus the ipa 
> user-* commands don’t work.

"User Administrator" role has "User Administrators" privilege, which 
contains the permission "System: Add Users" and should grant add access 
to create a user.
Are you seeing the above role/privilege/permission in your setup?
flo

[1] 
https://github.com/freeipa/freeipa/blob/master/install/ui/src/freeipa/Applic...
> Is this a well known bug/limitation? How do you go about providing role 
> assigned principals with means to act upon the privileges they posses?
>
> Regards
> Kristof
> > On Sep 21, 2018, at 4:12 PM, Florence Blanc-Renaud <[e-mail] 
> > > wrote:
> >
> > On 9/21/18 2:06 PM, kwtygrys via FreeIPA-users wrote:
> > > Hi
> > > I am running Freeipa 4.5.4 on Centos 7 server. I created a few users 
> > > hradmin, itadmin, secadmin and assigned them to the built-in special 
> > > roles User Administrator, IT Specialist and IT Security Specialist 
> > > respectively. However every time I try to access the Web UI as one of 
> > > those users I always get the WebUI in self-service mode, ie. I can 
> > > not take advantage of the privileges/permissions these users have. I 
> > > only get the WebUI administration mode when logging in as admin.
> > > Is there anything I am missing in terms of configuration?
> >
> > Hi,
> > IIRC a user has access to the whole WebUI administration when he is a 
> > member of the "admins" group.
> >
> > flo
> > > Regards
> > > Kristof
> > > _______________________________________________
> > > FreeIPA-users mailing list -- [e-mail] 
> > >
> > > To unsubscribe send an email to 
> > > [e-mail] 
> > >
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: 
> > > https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...