RBAC User Permissions Not Applied Properly in VMware Telco Cloud Platform

Products

• VMware Telco Cloud Platform

Issue/Introduction

Symptoms:

RBAC user is associated with multiple types of permissions, for example:

• One permission for User1 for VIM without any filters.
• One more permission for User1 for VIM with filters based on Tags (vim.tags = foo).
• When logged in as User1, the user can only see vims with tag "foo" (Logical AND is applied here).
• Expected behavior: The user should be able to see all VIMs as Logical OR should be applied between both the permissions. 

Environment

VMware Telco Cloud Platform 5.0

Cause

When an RBAC user is associated with multiple types of permissions, where one permission is based on filters such as tags and another permission is without filters, permissions are applied using a Logical AND operation instead of a Logical OR operation. Whereas it should be Logical OR between permissions.

Resolution

Upgrade to VMware Telco Cloud Platform 5.0.1 or later version to fix this issue.

Workaround: 
While configuring permissions, set the filters such that all the required resources are accessible. If the user needs to access all the resources, do not define filters in any permission.