IT11240: NON-ADMIN USER CANNOT ADD CLOUD GROUP TO ENVIRONMENT PROFILE WITHOUT WORKLOAD ADMINISTRATION MANAGE AUTHORITY

IBM PureApplication System Version 2.1.2.0

APAR status

• Closed as program error.

Error description

• A non-admin user was able create and edit an environment
  profile and create and edit a cloud group, but
  was not able to add the cloud group to the environment profile.
  
  The non-admin user has permissions to create
  profiles and permission to create cloud groups, they
  should be able to add those cloud groups to the profile.
  

Local fix

• Two REST APIs are useful to confirm the user's authority:
  
  1. List all users:   /resources/users
     1a. Find the "ID" of the specific user:  "id": 914
  
  2. List the roles for the userid with "id": 123:
         resources/users/123/roles
  
  32,2,33,5,6,7,8,9,10,11,13,14,15,17,16,21,23,22,24,31,30
  
  
  If the list of roles for the specific user is missing role 3,
  a workaround is to add the workload resources read/write
  permission to the user privileges.
  
  1. Select System > Users
  2. Select the specific user
  3. Under heading Administrators,
       Select check box     Workload resources administration
       Select radio button: Manage workload resources (Full
                                                    permission)
  

Problem summary

• The environment profile utility code checking the
  authorization of each user to perform each action needs to be
  corrected.
  

Problem conclusion

• A code fix is being provided in PureApplication System
  version 2.1.2.0.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  PAPP SYS 8382 I

• Fixed component ID

  5725G3200

Applicable component levels

• R212 PSY

     UP