list routers issues by domain admin

[weizhouapache]

API listRouters is permitted to domain admin since the implementation of dynamic roles.

the file engine/schema/src/main/resources/META-INF/db/create-default-role-api-mappings.sql has the following sql

INSERT INTO `cloud`.`role_permissions` (`uuid`, `role_id`, `rule`, `permission`, `sort_order`) values (UUID(), 3, 'listRouters', 'ALLOW', 194) ON DUPLICATE KEY UPDATE rule=rule;

There are few issues on UI
(1) domain admin can list virtual routers of isolated networks , but get a 404 error when view the details of routers.
(2) the api response of listrouters does not have information of guest nic
(3) domain admin cannot list virtual routers of shared networks (scope is Domain or Account).

First of all, do we need to add this role permission by default ?

ISSUE TYPE

• Bug Report

COMPONENT NAME

API, UI

CLOUDSTACK VERSION

4.17.0.0

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

STEPS TO REPRODUCE

EXPECTED RESULTS

ACTUAL RESULTS

[yadvr]

Hi @weizhouapache this sounds like a bug, have you checked git history - if git history confirms that listRouters shouldn'be allowed for domain admin - let's remove this at least from default/in-built roles in an upgrade path in 4.17.0.0. cc @nvazquez @Pearl1594

[weizhouapache]

Hi @weizhouapache this sounds like a bug, have you checked git history - if git history confirms that listRouters shouldn'be allowed for domain admin - let's remove this at least from default/in-built roles in an upgrade path in 4.17.0.0. cc @nvazquez @Pearl1594

@rohityadavcloud
I just checked the deprecated client/tomcatconf/commands.properties.in, it looks these APIs are allowed for domain admin.
if so, let's fix the bugs.

#### router commands
startRouter=7
rebootRouter=7
stopRouter=7
destroyRouter=7
changeServiceForRouter=7
listRouters=7
listVirtualRouterElements=7
configureVirtualRouterElement=7
createVirtualRouterElement=7
upgradeRouterTemplate=1

[yadvr]

If the listRouters is an allowed API historically, perhaps it was never meant to be supported in the UI? So, it's worth discussing how we fix the bug or do anything about it in the UI?

[DaanHoogland]

As a domain admin I would like to see the routers and the internal nics, I'm not sure if I would need to see all router attributes as domain admin.

[weizhouapache]

As a domain admin I would like to see the routers and the internal nics, I'm not sure if I would need to see all router attributes as domain admin.

@DaanHoogland
different from your opinion, as a root admin I do not expect this informatoin to be visible for domain admin :-)

[DaanHoogland]

As a domain admin I would like to see the routers and the internal nics, I'm not sure if I would need to see all router attributes as domain admin.

@DaanHoogland
different from your opinion, as a root admin I do not expect this informatoin to be visible for domain admin :-)

Right, meaning it should be configurable, should it?