Access configuration to Business Process overwritten

[lx183]

Access for user, who should have access to all Business Process Views is restricted by group membership in another group, which has businessprocess/prefix filter set.

Expected Behavior

User belonging to two different groups, one a group which has no filter set for business processes in Configuration-> Authentication and one group with restricted for a specific prefix, should be able to see all Business Process Views. Even if membership in one group with businessprocess prefix filter would restrict it.

Current Behavior

User is only able see the restricted business process views.

Possible Solution

Do not overwrite access configuration, if one group grants full access.

Steps to Reproduce (for bugs)

Add a user to two groups:

1. One group has full access to all business process views
2. One has only access to a filtered list of business process views (businessprocess/prefix)

Context

User has restricted rights and therefore not able to see businessprocess views

Your Environment

BP Version 2.1.0
icingaweb2-2.6.2-1.el7.icinga.noarch
icinga2 - The Icinga 2 network monitoring daemon (version: r2.10.2-1)

System information:
Platform: Red Hat Enterprise Linux Server
Platform version: 7.6 (Maipo)
Kernel: Linux
Kernel version: 3.10.0-957.1.3.el7.x86_64
Architecture: x86_64

httpd-2.4.6-88.el7.x86_64

[lx183]

User in both Roles via two groups

[lx183]

Would assume the issue is located here:

library/Businessprocess/Web/Form/BpConfigBaseForm.php

[nilmerg]

Hi, yes, that's an issue. Thanks for the report.

[slalomsk8er]

I have the same Problem but maybe I just didn't get the syntax right. I tired to give the group with more rights multiple prefixes - x|y|z. This didn't work like it did for monitoring/filter/objects.
Maybe I'm to stupid or this stuff could use some better documentation.

[nilmerg]

Fixed in the master soon. Users with memberships in multiple roles/groups are supposed to have a consolidated list of restricted prefixes. If one role permits full access, it can do so by providing the permission businessprocess/showall. This permission is already configurable, but has not the promised effect yet.

@slalomsk8er There is currently no support for multiple prefixes per role.