Description of problem:
Given:
We have created a user in RedHat IDM "enrollment-user"
We have granted that user the Role "IT Specialist" which has the Priviledge
"Host Administrators"
When:
We authenticate as enrollment-user using RedHat IDM api with curl and send
payload using the "host_del" api method to attempt to delete a host
Then:
We get an error "Insufficient access"
Full response - {"result": null, "error": {"code": 2100, "message":
"Insufficient access: ", "data": {"info": ""}, "name": "ACIError"}, "id": 0,
"principal": "enrollment-user@LINUXTEST.ORG.COM", "version": "4.8.7"}
Problem:
If you try to host_del for a host that does not exist, the API returns the
misleading error "Insufficient Access" if run as non-admin, but if you run as
admin for a non-existing host, the correct response is returned indicating that
host as "failed" to remove, example response:
{ "method": "host_del", "params": [ [ "system04.org.com" ], { "continue": true,
"version": 2.235 } ], "id": 0 }
{"result": {"result": {"failed": ["system04.org.com"]}, "value": [], "summary":
"Deleted host \"\""}, "error": null, "id": 0, "principal":
"admin@LINUXTEST.ORG.COM", "version": "4.8.7"}
It seems like this is not an access problem, it's just an API response
messaging problem.  So, from my API usage perspective, I'm able to do what I
need to do using non-admin user, but I am unable to distinguish between access
problems and invalid host problems.  I will work around that for now by
assuming any Insufficient Access error could also mean the host was already
cleaned up.  Let me know if you want any more information, but at this point
I'd say I would just suggest to the product team that the response messaging be
improved in this case as a fix some time in the future.