Grant access to 2FA APIs for default read-only and support roles by bernardodemarco · Pull Request #10273 · apache/cloudstack

bernardodemarco · 2025-01-25T20:55:26Z

Description

Accounts created with the Read-Only User - Default and Support User - Default roles do not have access to setupUserTwoFactorAuthentication, validateUserTwoFactorAuthenticationCode and listUserTwoFactorAuthenticatorProviders APIs. Additionally, accounts created with the Read-Only Admin - Default and Support Admin - Default roles only have access to the listUserTwoFactorAuthenticatorProviders API.

As a consequence, when 2FA is required for authentication, accounts with these roles cannot login into CloudStack. Thus, this PR proposes to grant access to the 2FA-related APIs for the previously mentioned roles.

Fixes #10269

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Screenshots (if appropriate):

How Has This Been Tested?

`Read-Only User - Default`

Role permissions before changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only User - Default') order by sort_order;
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                            | permission | description | sort_order |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
|  894 | 36edece5-a510-11ef-8a39-9a34acb639ea |       6 | listAccounts                    | ALLOW      | NULL        |          0 |
|  895 | 36edf63d-a510-11ef-8a39-9a34acb639ea |       6 | listAffinityGroupTypes          | ALLOW      | NULL        |          1 |
|  896 | 36edfd6c-a510-11ef-8a39-9a34acb639ea |       6 | listAffinityGroups              | ALLOW      | NULL        |          2 |
|  897 | 36ee0450-a510-11ef-8a39-9a34acb639ea |       6 | listApis                        | ALLOW      | NULL        |          3 |
// (...)
|  971 | 36f02736-a510-11ef-8a39-9a34acb639ea |       6 | cloudianIsEnabled               | ALLOW      | NULL        |         77 |
|  972 | 36f02baf-a510-11ef-8a39-9a34acb639ea |       6 | queryAsyncJobResult             | ALLOW      | NULL        |         78 |
|  973 | 36f02fc1-a510-11ef-8a39-9a34acb639ea |       6 | quotaIsEnabled                  | ALLOW      | NULL        |         79 |
|  974 | 36f0336d-a510-11ef-8a39-9a34acb639ea |       6 | quotaTariffList                 | ALLOW      | NULL        |         80 |
|  975 | 36f0371a-a510-11ef-8a39-9a34acb639ea |       6 | quotaSummary                    | ALLOW      | NULL        |         81 |
| 1117 | 38c4a78b-a510-11ef-8a39-9a34acb639ea |       6 | quotaBalance                    | ALLOW      | NULL        |         82 |
| 1116 | 38c4617d-a510-11ef-8a39-9a34acb639ea |       6 | quotaStatement                  | ALLOW      | NULL        |         83 |
| 1125 | 39fc9915-a510-11ef-8a39-9a34acb639ea |       6 | quotaStatementDetails           | ALLOW      | NULL        |         83 |
| 1132 | 39fd0d57-a510-11ef-8a39-9a34acb639ea |       6 | quotaCreditsList                | ALLOW      | NULL        |         83 |
|  976 | 36f040d1-a510-11ef-8a39-9a34acb639ea |       6 | *                               | DENY       | NULL        |         84 |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
84 rows in set (0.002 sec)

Role permissions after changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only User - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                                    | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
|  894 | 36edece5-a510-11ef-8a39-9a34acb639ea |       6 | listAccounts                            | ALLOW      | NULL        |          0 |
|  895 | 36edf63d-a510-11ef-8a39-9a34acb639ea |       6 | listAffinityGroupTypes                  | ALLOW      | NULL        |          1 |
|  896 | 36edfd6c-a510-11ef-8a39-9a34acb639ea |       6 | listAffinityGroups                      | ALLOW      | NULL        |          2 |
|  897 | 36ee0450-a510-11ef-8a39-9a34acb639ea |       6 | listApis                                | ALLOW      | NULL        |          3 |
(...)
|  971 | 36f02736-a510-11ef-8a39-9a34acb639ea |       6 | cloudianIsEnabled                       | ALLOW      | NULL        |         77 |
|  972 | 36f02baf-a510-11ef-8a39-9a34acb639ea |       6 | queryAsyncJobResult                     | ALLOW      | NULL        |         78 |
|  973 | 36f02fc1-a510-11ef-8a39-9a34acb639ea |       6 | quotaIsEnabled                          | ALLOW      | NULL        |         79 |
|  974 | 36f0336d-a510-11ef-8a39-9a34acb639ea |       6 | quotaTariffList                         | ALLOW      | NULL        |         80 |
|  975 | 36f0371a-a510-11ef-8a39-9a34acb639ea |       6 | quotaSummary                            | ALLOW      | NULL        |         81 |
| 1117 | 38c4a78b-a510-11ef-8a39-9a34acb639ea |       6 | quotaBalance                            | ALLOW      | NULL        |         82 |
| 1116 | 38c4617d-a510-11ef-8a39-9a34acb639ea |       6 | quotaStatement                          | ALLOW      | NULL        |         83 |
| 1125 | 39fc9915-a510-11ef-8a39-9a34acb639ea |       6 | quotaStatementDetails                   | ALLOW      | NULL        |         83 |
| 1132 | 39fd0d57-a510-11ef-8a39-9a34acb639ea |       6 | quotaCreditsList                        | ALLOW      | NULL        |         83 |
| 1133 | 1da34356-db5a-11ef-878d-9a34acb639ea |       6 | setupUserTwoFactorAuthentication        | ALLOW      | NULL        |         84 |
| 1134 | 1da3b3a9-db5a-11ef-878d-9a34acb639ea |       6 | validateUserTwoFactorAuthenticationCode | ALLOW      | NULL        |         85 |
| 1135 | 1e15b3aa-db5a-11ef-878d-9a34acb639ea |       6 | listUserTwoFactorAuthenticatorProviders | ALLOW      | NULL        |         86 |
|  976 | 36f040d1-a510-11ef-8a39-9a34acb639ea |       6 | *                                       | DENY       | NULL        |         87 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
87 rows in set (0.001 sec)

`Support User - Default`

Role permissions before changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support User - Default') order by sort_order;
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                            | permission | description | sort_order |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
| 1006 | 36f134fd-a510-11ef-8a39-9a34acb639ea |       8 | listAccounts                    | ALLOW      | NULL        |          0 |
| 1007 | 36f13e2d-a510-11ef-8a39-9a34acb639ea |       8 | listAffinityGroupTypes          | ALLOW      | NULL        |          1 |
| 1008 | 36f1432c-a510-11ef-8a39-9a34acb639ea |       8 | listAffinityGroups              | ALLOW      | NULL        |          2 |
| 1009 | 36f1478f-a510-11ef-8a39-9a34acb639ea |       8 | listApis                        | ALLOW      | NULL        |          3 |
| 1010 | 36f14ba1-a510-11ef-8a39-9a34acb639ea |       8 | listAsyncJobs                   | ALLOW      | NULL        |          4 |
(...)
| 1093 | 36f3c18c-a510-11ef-8a39-9a34acb639ea |       8 | createVolume                    | ALLOW      | NULL        |         87 |
| 1094 | 36f3c780-a510-11ef-8a39-9a34acb639ea |       8 | attachVolume                    | ALLOW      | NULL        |         88 |
| 1095 | 36f3cb45-a510-11ef-8a39-9a34acb639ea |       8 | detachVolume                    | ALLOW      | NULL        |         89 |
| 1096 | 36f3cee0-a510-11ef-8a39-9a34acb639ea |       8 | uploadVolume                    | ALLOW      | NULL        |         90 |
| 1097 | 36f3d2da-a510-11ef-8a39-9a34acb639ea |       8 | attachIso                       | ALLOW      | NULL        |         91 |
| 1098 | 36f3d6f6-a510-11ef-8a39-9a34acb639ea |       8 | detachIso                       | ALLOW      | NULL        |         92 |
| 1099 | 36f3da8a-a510-11ef-8a39-9a34acb639ea |       8 | registerTemplate                | ALLOW      | NULL        |         93 |
| 1100 | 36f3de07-a510-11ef-8a39-9a34acb639ea |       8 | registerIso                     | ALLOW      | NULL        |         94 |
| 1101 | 36f3e187-a510-11ef-8a39-9a34acb639ea |       8 | getUploadParamsFor*             | ALLOW      | NULL        |         95 |
| 1102 | 36f3e4fe-a510-11ef-8a39-9a34acb639ea |       8 | *                               | DENY       | NULL        |         96 |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
94 rows in set (0.002 sec)

Role permissions after changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support User - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                                    | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| 1006 | 36f134fd-a510-11ef-8a39-9a34acb639ea |       8 | listAccounts                            | ALLOW      | NULL        |          0 |
| 1007 | 36f13e2d-a510-11ef-8a39-9a34acb639ea |       8 | listAffinityGroupTypes                  | ALLOW      | NULL        |          1 |
| 1008 | 36f1432c-a510-11ef-8a39-9a34acb639ea |       8 | listAffinityGroups                      | ALLOW      | NULL        |          2 |
| 1009 | 36f1478f-a510-11ef-8a39-9a34acb639ea |       8 | listApis                                | ALLOW      | NULL        |          3 |
| 1010 | 36f14ba1-a510-11ef-8a39-9a34acb639ea |       8 | listAsyncJobs                           | ALLOW      | NULL        |          4 |
(...)
| 1093 | 36f3c18c-a510-11ef-8a39-9a34acb639ea |       8 | createVolume                            | ALLOW      | NULL        |         87 |
| 1094 | 36f3c780-a510-11ef-8a39-9a34acb639ea |       8 | attachVolume                            | ALLOW      | NULL        |         88 |
| 1095 | 36f3cb45-a510-11ef-8a39-9a34acb639ea |       8 | detachVolume                            | ALLOW      | NULL        |         89 |
| 1096 | 36f3cee0-a510-11ef-8a39-9a34acb639ea |       8 | uploadVolume                            | ALLOW      | NULL        |         90 |
| 1097 | 36f3d2da-a510-11ef-8a39-9a34acb639ea |       8 | attachIso                               | ALLOW      | NULL        |         91 |
| 1098 | 36f3d6f6-a510-11ef-8a39-9a34acb639ea |       8 | detachIso                               | ALLOW      | NULL        |         92 |
| 1099 | 36f3da8a-a510-11ef-8a39-9a34acb639ea |       8 | registerTemplate                        | ALLOW      | NULL        |         93 |
| 1100 | 36f3de07-a510-11ef-8a39-9a34acb639ea |       8 | registerIso                             | ALLOW      | NULL        |         94 |
| 1101 | 36f3e187-a510-11ef-8a39-9a34acb639ea |       8 | getUploadParamsFor*                     | ALLOW      | NULL        |         95 |
| 1136 | 5984107f-db5a-11ef-878d-9a34acb639ea |       8 | setupUserTwoFactorAuthentication        | ALLOW      | NULL        |         96 |
| 1137 | 5984d54a-db5a-11ef-878d-9a34acb639ea |       8 | validateUserTwoFactorAuthenticationCode | ALLOW      | NULL        |         97 |
| 1138 | 5a25bb08-db5a-11ef-878d-9a34acb639ea |       8 | listUserTwoFactorAuthenticatorProviders | ALLOW      | NULL        |         98 |
| 1102 | 36f3e4fe-a510-11ef-8a39-9a34acb639ea |       8 | *                                       | DENY       | NULL        |         99 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
97 rows in set (0.003 sec)

`Read-Only Admin - Default`

Role permissions before changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only Admin - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                  | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------+------------+-------------+------------+
|  885 | 36ed8afa-a510-11ef-8a39-9a34acb639ea |       5 | list*                 | ALLOW      | NULL        |          0 |
|  886 | 36ed9278-a510-11ef-8a39-9a34acb639ea |       5 | getUploadParamsFor*   | DENY       | NULL        |          1 |
|  887 | 36ed97b5-a510-11ef-8a39-9a34acb639ea |       5 | get*                  | ALLOW      | NULL        |          2 |
|  888 | 36ed9bb8-a510-11ef-8a39-9a34acb639ea |       5 | cloudianIsEnabled     | ALLOW      | NULL        |          3 |
|  889 | 36ed9f83-a510-11ef-8a39-9a34acb639ea |       5 | queryAsyncJobResult   | ALLOW      | NULL        |          4 |
|  890 | 36eda459-a510-11ef-8a39-9a34acb639ea |       5 | quotaIsEnabled        | ALLOW      | NULL        |          5 |
|  891 | 36eda8be-a510-11ef-8a39-9a34acb639ea |       5 | quotaTariffList       | ALLOW      | NULL        |          6 |
|  892 | 36edada1-a510-11ef-8a39-9a34acb639ea |       5 | quotaSummary          | ALLOW      | NULL        |          7 |
| 1115 | 38c3b20d-a510-11ef-8a39-9a34acb639ea |       5 | quotaBalance          | ALLOW      | NULL        |          8 |
| 1114 | 38c35a0f-a510-11ef-8a39-9a34acb639ea |       5 | quotaStatement        | ALLOW      | NULL        |          9 |
| 1124 | 39fc98e9-a510-11ef-8a39-9a34acb639ea |       5 | quotaStatementDetails | ALLOW      | NULL        |          9 |
| 1131 | 39fd0d35-a510-11ef-8a39-9a34acb639ea |       5 | quotaCreditsList      | ALLOW      | NULL        |          9 |
|  893 | 36edb1f6-a510-11ef-8a39-9a34acb639ea |       5 | *                     | DENY       | NULL        |         10 |
+------+--------------------------------------+---------+-----------------------+------------+-------------+------------+
13 rows in set (0.001 sec)

Role permissions after changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only Admin - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                                    | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
|  885 | 36ed8afa-a510-11ef-8a39-9a34acb639ea |       5 | list*                                   | ALLOW      | NULL        |          0 |
|  886 | 36ed9278-a510-11ef-8a39-9a34acb639ea |       5 | getUploadParamsFor*                     | DENY       | NULL        |          1 |
|  887 | 36ed97b5-a510-11ef-8a39-9a34acb639ea |       5 | get*                                    | ALLOW      | NULL        |          2 |
|  888 | 36ed9bb8-a510-11ef-8a39-9a34acb639ea |       5 | cloudianIsEnabled                       | ALLOW      | NULL        |          3 |
|  889 | 36ed9f83-a510-11ef-8a39-9a34acb639ea |       5 | queryAsyncJobResult                     | ALLOW      | NULL        |          4 |
|  890 | 36eda459-a510-11ef-8a39-9a34acb639ea |       5 | quotaIsEnabled                          | ALLOW      | NULL        |          5 |
|  891 | 36eda8be-a510-11ef-8a39-9a34acb639ea |       5 | quotaTariffList                         | ALLOW      | NULL        |          6 |
|  892 | 36edada1-a510-11ef-8a39-9a34acb639ea |       5 | quotaSummary                            | ALLOW      | NULL        |          7 |
| 1115 | 38c3b20d-a510-11ef-8a39-9a34acb639ea |       5 | quotaBalance                            | ALLOW      | NULL        |          8 |
| 1114 | 38c35a0f-a510-11ef-8a39-9a34acb639ea |       5 | quotaStatement                          | ALLOW      | NULL        |          9 |
| 1124 | 39fc98e9-a510-11ef-8a39-9a34acb639ea |       5 | quotaStatementDetails                   | ALLOW      | NULL        |          9 |
| 1131 | 39fd0d35-a510-11ef-8a39-9a34acb639ea |       5 | quotaCreditsList                        | ALLOW      | NULL        |          9 |
| 1139 | 98c7cfdf-db5a-11ef-878d-9a34acb639ea |       5 | setupUserTwoFactorAuthentication        | ALLOW      | NULL        |         10 |
| 1140 | 9a27c65c-db5a-11ef-878d-9a34acb639ea |       5 | validateUserTwoFactorAuthenticationCode | ALLOW      | NULL        |         11 |
|  893 | 36edb1f6-a510-11ef-8a39-9a34acb639ea |       5 | *                                       | DENY       | NULL        |         12 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
15 rows in set (0.000 sec)

`Support Admin - Default`

Role permissions before changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support Admin - Default') order by sort_order;
+------+--------------------------------------+---------+---------------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                      | permission | description | sort_order |
+------+--------------------------------------+---------+---------------------------+------------+-------------+------------+
|  977 | 36f07380-a510-11ef-8a39-9a34acb639ea |       7 | list*                     | ALLOW      | NULL        |          0 |
|  978 | 36f07a1d-a510-11ef-8a39-9a34acb639ea |       7 | get*                      | ALLOW      | NULL        |          1 |
|  979 | 36f07f3b-a510-11ef-8a39-9a34acb639ea |       7 | cloudianIsEnabled         | ALLOW      | NULL        |          2 |
|  980 | 36f084f5-a510-11ef-8a39-9a34acb639ea |       7 | queryAsyncJobResult       | ALLOW      | NULL        |          3 |
|  981 | 36f0893b-a510-11ef-8a39-9a34acb639ea |       7 | quotaIsEnabled            | ALLOW      | NULL        |          4 |
(...)
| 1002 | 36f0e049-a510-11ef-8a39-9a34acb639ea |       7 | detachIso                 | ALLOW      | NULL        |         25 |
| 1003 | 36f0e45b-a510-11ef-8a39-9a34acb639ea |       7 | registerTemplate          | ALLOW      | NULL        |         26 |
| 1004 | 36f0eabb-a510-11ef-8a39-9a34acb639ea |       7 | registerIso               | ALLOW      | NULL        |         27 |
| 1005 | 36f0f3c4-a510-11ef-8a39-9a34acb639ea |       7 | *                         | DENY       | NULL        |         28 |
+------+--------------------------------------+---------+---------------------------+------------+-------------+------------+
29 rows in set (0.001 sec)

Role permissions after changes

MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support Admin - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id   | uuid                                 | role_id | rule                                    | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
|  977 | 36f07380-a510-11ef-8a39-9a34acb639ea |       7 | list*                                   | ALLOW      | NULL        |          0 |
|  978 | 36f07a1d-a510-11ef-8a39-9a34acb639ea |       7 | get*                                    | ALLOW      | NULL        |          1 |
|  979 | 36f07f3b-a510-11ef-8a39-9a34acb639ea |       7 | cloudianIsEnabled                       | ALLOW      | NULL        |          2 |
|  980 | 36f084f5-a510-11ef-8a39-9a34acb639ea |       7 | queryAsyncJobResult                     | ALLOW      | NULL        |          3 |
|  981 | 36f0893b-a510-11ef-8a39-9a34acb639ea |       7 | quotaIsEnabled                          | ALLOW      | NULL        |          4 |
(...)
| 1002 | 36f0e049-a510-11ef-8a39-9a34acb639ea |       7 | detachIso                               | ALLOW      | NULL        |         25 |
| 1003 | 36f0e45b-a510-11ef-8a39-9a34acb639ea |       7 | registerTemplate                        | ALLOW      | NULL        |         26 |
| 1004 | 36f0eabb-a510-11ef-8a39-9a34acb639ea |       7 | registerIso                             | ALLOW      | NULL        |         27 |
| 1141 | a1159975-db5a-11ef-878d-9a34acb639ea |       7 | setupUserTwoFactorAuthentication        | ALLOW      | NULL        |         28 |
| 1142 | a11714c1-db5a-11ef-878d-9a34acb639ea |       7 | validateUserTwoFactorAuthenticationCode | ALLOW      | NULL        |         29 |
| 1005 | 36f0f3c4-a510-11ef-8a39-9a34acb639ea |       7 | *                                       | DENY       | NULL        |         30 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
31 rows in set (0.001 sec)

bernardodemarco · 2025-01-25T21:02:37Z

Guys, should the changes in this PR also be applied to versions 4.19 and 4.20? If so, I think it would be necessary to open a new PR targeting each version branch, right?

codecov · 2025-01-25T21:02:47Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 16.20%. Comparing base (98f5663) to head (bdb4d98).
Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #10273   +/-   ##
=========================================
  Coverage     16.19%   16.20%           
- Complexity    13051    13061   +10     
=========================================
  Files          5645     5645           
  Lines        494567   494634   +67     
  Branches      59955    59963    +8     
=========================================
+ Hits          80088    80144   +56     
- Misses       405642   405653   +11     
  Partials       8837     8837

Flag	Coverage Δ
uitests	`4.01% <ø> (ø)`
unittests	`17.05% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

bernardodemarco · 2025-01-25T21:03:20Z

@blueorangutan package

blueorangutan · 2025-01-25T21:04:03Z

@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-01-25T22:09:17Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12208

harikrishna-patnala

thanks for the PR.

Is it not better to handle this in upgrade java class as a generic method, so that we can use that method for multiple APIs and in future also ?

or may be a procedure something like

DELIMITER $$

CREATE PROCEDURE `IDEMPOTENT_UPDATE_SINGLE_API_PERMISSION`(
    IN role_name VARCHAR(255),
    IN api_rule VARCHAR(255),
    IN api_permission VARCHAR(10)
)
BEGIN
    DECLARE roleId BIGINT;
    DECLARE maxSortOrder INT;

    SELECT `id`
    INTO roleId
    FROM `cloud`.`roles`
    WHERE `name` = role_name
      AND `is_default` = 1;

    UPDATE `cloud`.`role_permissions`
    SET `sort_order` = `sort_order` + 1
    WHERE `rule` = '*'
      AND `role_id` = roleId;

    SELECT MAX(`sort_order`)
    INTO maxSortOrder
    FROM `cloud`.`role_permissions`
    WHERE `role_id` = roleId;

    IF NOT EXISTS (
        SELECT 1
        FROM `cloud`.`role_permissions`
        WHERE `role_id` = roleId
          AND `rule` = api_rule
    ) THEN
        INSERT INTO `cloud`.`role_permissions`
            (uuid, role_id, rule, permission, sort_order)
        VALUES
            (uuid(), roleId, api_rule, api_permission, maxSortOrder + 1);
    END IF;
END$$

DELIMITER ;

Note: I've not testes this procedure, but a pseudo code.

bernardodemarco · 2025-01-27T11:32:24Z

@harikrishna-patnala, thanks for your review. I believe that it would be better to create the SQL procedure to abstract this operation. I'll be working on it and, in the meantime, I'll put the PR in draft.

bernardodemarco · 2025-01-28T23:21:04Z

@blueorangutan package

blueorangutan · 2025-01-28T23:22:03Z

@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

bernardodemarco · 2025-01-29T00:00:09Z

Okay, it seems there are some syntax errors in the SQL script. I'll take a closer look at it tomorrow.

blueorangutan · 2025-01-29T00:28:50Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12247

DaanHoogland

clgtm

DaanHoogland · 2025-01-29T09:35:47Z

@bernardodemarco , this is marked for release 21 now, would you consider moving it to an earlier release?

github-actions · 2025-01-29T11:28:20Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

bernardodemarco · 2025-01-29T11:32:41Z

@bernardodemarco , this is marked for release 21 now, would you consider moving it to an earlier release?

Yes, no problem. Should I target it to 4.19 or 4.20?

DaanHoogland · 2025-01-29T12:51:32Z

@bernardodemarco , this is marked for release 21 now, would you consider moving it to an earlier release?

Yes, no problem. Should I target it to 4.19 or 4.20?

4.19 is fine but a bit late and as this needs adjustment of the sql file , you could choose to go for 4.20. On the other hand the current implementation is suitable to be in more than one upgrade path, so if you are adventurous ... ;)

bernardodemarco · 2025-01-29T17:25:06Z

4.19 is fine but a bit late and as this needs adjustment of the sql file , you could choose to go for 4.20. On the other hand the current implementation is suitable to be in more than one upgrade path, so if you are adventurous ... ;)

@DaanHoogland @harikrishna-patnala, I've just fixed the SQL syntax errors and targeted it to 4.19

harikrishna-patnala · 2025-01-30T07:32:54Z

@blueorangutan package

blueorangutan · 2025-01-30T07:34:04Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-01-30T08:36:52Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12268

harikrishna-patnala

LGTM. tested with admin and readonly user accounts on a new environment.

bernardodemarco · 2025-01-30T15:45:06Z

@DaanHoogland, should I open another PR targeting the 4.20 branch and adding the SQL queries to the schema-42000to42010.sql file?

DaanHoogland · 2025-01-30T16:23:15Z

@DaanHoogland, should I open another PR targeting the 4.20 branch and adding the SQL queries to the schema-42000to42010.sql file?

those are two half statements @bernardodemarco , and the answer to both is "maybe yes", but...
on 4.20 you should add the statements to the 419xx to 4.20 file and
on main you should add those statements to the file you nention.
I am not sure if these are needed in all cases. It depends on our order of releasing a bit. But to make sure we don't forget it is wisest to add both PRs for now and we can discuss/decide later.

bernardodemarco added the status:needs-testing label Jan 25, 2025

harikrishna-patnala reviewed Jan 27, 2025

View reviewed changes

bernardodemarco changed the title ~~Grant access to 2FA APIs for default read-only and support roles~~ draft: Grant access to 2FA APIs for default read-only and support roles Jan 27, 2025

bernardodemarco marked this pull request as draft January 27, 2025 11:34

DaanHoogland added this to the 4.21.0 milestone Jan 27, 2025

bernardodemarco marked this pull request as ready for review January 28, 2025 23:19

bernardodemarco changed the title ~~draft: Grant access to 2FA APIs for default read-only and support roles~~ Grant access to 2FA APIs for default read-only and support roles Jan 28, 2025

bernardodemarco requested a review from harikrishna-patnala January 28, 2025 23:19

bernardodemarco added the status:needs-review label Jan 28, 2025

bernardodemarco marked this pull request as draft January 28, 2025 23:57

bernardodemarco changed the title ~~Grant access to 2FA APIs for default read-only and support roles~~ draft: Grant access to 2FA APIs for default read-only and support roles Jan 28, 2025

DaanHoogland approved these changes Jan 29, 2025

View reviewed changes

github-actions bot added the status:has-conflicts label Jan 29, 2025

fix SQL syntax erros and target 419

0375303

bernardodemarco force-pushed the update-readonly-roles branch from bdb4d98 to 0375303 Compare January 29, 2025 17:18

boring-cyborg bot added the component:storage label Jan 29, 2025

bernardodemarco changed the base branch from main to 4.19 January 29, 2025 17:18

bernardodemarco marked this pull request as ready for review January 29, 2025 17:19

bernardodemarco removed component:storage status:needs-review labels Jan 29, 2025

bernardodemarco modified the milestones: 4.21.0, 4.19.2 Jan 29, 2025

bernardodemarco changed the title ~~draft: Grant access to 2FA APIs for default read-only and support roles~~ Grant access to 2FA APIs for default read-only and support roles Jan 29, 2025

github-actions bot removed the status:has-conflicts label Jan 29, 2025

harikrishna-patnala approved these changes Jan 30, 2025

View reviewed changes

DaanHoogland added status:ready-for-merge and removed status:needs-testing labels Jan 30, 2025

DaanHoogland merged commit d9af9bd into apache:4.19 Jan 30, 2025

DaanHoogland mentioned this pull request Jan 30, 2025

Users with ‘Read Only User - Default’ or ‘Support User - Default’ roles are unable to activate and use 2FA #10269

Closed

rg9975 pushed a commit to rg9975/cloudstack that referenced this pull request Jan 31, 2025

fix SQL syntax erros and target 419 (apache#10273)

094912d

bernardodemarco mentioned this pull request Apr 13, 2025

Backport #10273 to 4.20: Grant access to 2FA APIs for default read-only and support roles #10702

Merged

14 tasks

dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Jun 19, 2025

fix SQL syntax erros and target 419 (apache#10273)

e2a2939

Conversation

bernardodemarco commented Jan 25, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Screenshots (if appropriate):

How Has This Been Tested?

Read-Only User - Default

Support User - Default

Read-Only Admin - Default

Support Admin - Default

Uh oh!

bernardodemarco commented Jan 25, 2025

Uh oh!

codecov bot commented Jan 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bernardodemarco commented Jan 25, 2025

Uh oh!

blueorangutan commented Jan 25, 2025

Uh oh!

blueorangutan commented Jan 25, 2025

Uh oh!

harikrishna-patnala left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bernardodemarco commented Jan 27, 2025

Uh oh!

bernardodemarco commented Jan 28, 2025

Uh oh!

blueorangutan commented Jan 28, 2025

Uh oh!

bernardodemarco commented Jan 29, 2025

Uh oh!

blueorangutan commented Jan 29, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Jan 29, 2025

Uh oh!

github-actions bot commented Jan 29, 2025

Uh oh!

bernardodemarco commented Jan 29, 2025

Uh oh!

DaanHoogland commented Jan 29, 2025

Uh oh!

bernardodemarco commented Jan 29, 2025

Uh oh!

harikrishna-patnala commented Jan 30, 2025

Uh oh!

blueorangutan commented Jan 30, 2025

Uh oh!

blueorangutan commented Jan 30, 2025

Uh oh!

harikrishna-patnala left a comment

Choose a reason for hiding this comment

Uh oh!

bernardodemarco commented Jan 30, 2025

Uh oh!

DaanHoogland commented Jan 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

`Read-Only User - Default`

`Support User - Default`

`Read-Only Admin - Default`

`Support Admin - Default`

codecov bot commented Jan 25, 2025 •

edited

Loading

harikrishna-patnala left a comment •

edited

Loading