A user (non admin) cannot view its own kickstart file
by Žarko Dudic
Hi, this is cobbler 2.8.3
A user (auth against LDAP) can create a kickstart file via web UI. But when attempting to see it (or any other kickstart file ), there is screen message
NOTE: You do not have permission to make changes to this kickstart template and can only read it. It is possible that other Cobbler users has secured permissions on Cobbler profiles/systems that depend on this template -- changing this template would ultimately affect those profile/system records which you do not have access to. Alternatively, you may not have access to edit *any* kickstart templates. Contact your Cobbler server administrator if you need to resolve this.
and cobbler.log reads:
Tue Dec 18 15:06:27 2018 - INFO | Exception occured: <type 'exceptions.AttributeError'>
Tue Dec 18 15:06:27 2018 - INFO | Exception value: 'str' object has no attribute 'owners'
Tue Dec 18 15:06:27 2018 - INFO | Exception Info:
File "/usr/lib/python2.7/site-packages/cobbler/remote.py", line 1831, in check_access_no_fail
self.check_access(token,resource,arg1,arg2)
File "/usr/lib/python2.7/site-packages/cobbler/remote.py", line 1843, in check_access
rc = self.api.authorize(user,resource,arg1,arg2)
File "/usr/lib/python2.7/site-packages/cobbler/api.py", line 1018, in authorize
rc = self.authz.authorize(self,user,resource,arg1,arg2)
File "/usr/lib/python2.7/site-packages/cobbler/modules/authz_ownership.py", line 196, in authorize
if obj is None or obj.owners is None or obj.owners == []:
Tue Dec 18 15:06:27 2018 - INFO | REMOTE is_kickstart_in_use; user(zdudic)
Tue Dec 18 15:06:27 2018 - DEBUG | get_items; ['profile']
Tue Dec 18 15:06:27 2018 - DEBUG | done with get_items; ['profile']
Tue Dec 18 15:06:27 2018 - DEBUG | get_items; ['system']
Tue Dec 18 15:06:27 2018 - DEBUG | done with get_items; ['system']
Tue Dec 18 15:06:27 2018 - INFO | REMOTE read_kickstart_template; user(zdudic); name(/var/lib/cobbler/kickstarts/test111)
Tue Dec 18 15:06:27 2018 - DEBUG | authorize; ['zdudic', 'read_kickstart_template', '/var/lib/cobbler/kickstarts/test111', True, 1]
Tue Dec 18 15:06:27 2018 - DEBUG | REMOTE zdudic authorization result: 1; user(?)
Tue Dec 18 15:06:27 2018 - INFO | REMOTE version; user(zdudic)
thanks for any help, Zarko
5 years, 4 months
- 1
- 1
Prevent change setting after webUI auth against LDAP
by Žarko Dudic
Hi there,
this is cobbler 2.8.3 and I've setup web UI to authenticate via LDAP. For authorization I am using authz_ownership with some LDAP accounts in some groups.
The problem is that anyone who login via web UI can change settings. How to prevent this?
5 years, 4 months
- 1
- 0
- ← Newer
- 1
- Older →