User with member role could see the admin tab

[Hao Chen]

We have deploymented an OpenStack cloud with newton release code. In horizon we found that even the member user could see the admin tab in horizon.

Admin tab should only been seen by the admin user in the cloud. And in mitaka we even have the limit that only cloud admin could see that admin tab. But this change https://github.com/openstack/horizon/commit/ce5fb26bf5f431f0cdaa6860a732338db868a8fb#diff-aff3bed89850c87f3629774f5a4599bcL23 breaks the previous behavior.

We should revert this change to give user the right privilege.

[Richard Jones (r1chardj0n3s)]

I need more information about your configuration. I can't see this with Horizon logging into a devstack as the "demo" user.

[Itxaka Serrano (itxaka)]

Also cant see this.

[Kenji Ishii (ken-ishii)]

Me too.
And if Cloud admin you mentioned expresses '("identity", "cloud_admin"),', I think it's natural.
Because that right has a meaning in Identity. It means, that right is not all of systems administrator.
Other components behavior should not depend on Keystone policy. From the view of this, Paul's change is reasonable for me.

[Martins Jakubovics (martins-k)]

Can confirm this bug when building horizon from latest newton source code. If revert patch which mentioned above, then all works as it should.

[Alejandro Comisario (alejandro-f)]

Is this fixed already ?

[Tadas Ustinavičius (tadas-u)]

Having same issue here. Freshly installed Openstack Newton via openstack-ansible.
Newly created user with _member_ role is able to see administration tab.
If any of links inside administration tab is pressed, error is displayed and user is logged out.

[Alejandro Comisario (alejandro-f)]

this makes horizon un-usable among other things

[andrew_shi (ashishenko)]

I have the same issue: user with role 'Member' or '_member_' can see tab 'Admin'. When 'member' click any item in tab 'Admin', it'll become 'log out'.
I have fresh installation release Newton (installed via openstack-ansible)

[HT (h5t4)]

Quick hack is to remove ALL panels under Admin like this (you must do same for rotuers,volumes,metering etc.):

cat site-packages/openstack_dashboard/local/enabled/_70_admin_remove_defaults.py
PANEL = 'defaults'
PANEL_DASHBOARD = 'admin'
PANEL_GROUP = 'admin'
REMOVE_PANEL = True

[David Lyle (david-lyle)]

I believe this was addressed by https://github.com/openstack/horizon/commit/43e9df85ab286ddee96e9cff97f551781baf70d1 but it may not have been backported to your release.

[David Lyle (david-lyle)]

Actually, it was backported to newton: https://review.openstack.org/#/c/407121/