Domain settings not visible to domain admin

[borisstoyanov]

ISSUE TYPE

• Improvement Request

COMPONENT NAME

API

CLOUDSTACK VERSION

<4.13

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

This looks it’s by design, but I’m sure there’s a good reason a domain admin to be able to edit settings.

(bobby) SBCM5> > update configuration domainid=0586ce1e-90e9-4e2b-9d2c-dc451b01033d name=ldap.provider value=somthign
🙈 Error: unknown command or API requested

STEPS TO REPRODUCE

EXPECTED RESULTS

As a domain admin I would expect to be able to change domain settings

ACTUAL RESULTS

API not available 

[weizhouapache]

@borisstoyanov
I agree it would be better to allow domain admin to edit "some" domain settings, same as account on account settings.
We need to figure out that which settings are editable and which are not.
it requires some database changes.

[yadvr]

cc @davidjumani @DaanHoogland can you review/verify this? Thanks.

[DaanHoogland]

@rhtyd @weizhouapache @borisstoyanov sounds like a valid feature request. @weizhouapache what db changes would we need? I see only a test for domain access to the mentioned domain as a requirement. What am i missing?

[weizhouapache]

@rhtyd @weizhouapache @borisstoyanov sounds like a valid feature request. @weizhouapache what db changes would we need? I see only a test for domain access to the mentioned domain as a requirement. What am i missing?

@DaanHoogland maybe a global config domain.admin.allow.details, like user.vm.blacklisted.details that we have ?

[davidjumani]

@DaanHoogland @weizhouapache Created a draft PR to allow domain admins to change domain and account level settings. Think it would be better to allow domain admins to change all domain / account settings rather than just a few. Can add a global config to allow them to change the settings at all

[weizhouapache]

@DaanHoogland @weizhouapache Created a draft PR to allow domain admins to change domain and account level settings. Think it would be better to allow domain admins to change all domain / account settings rather than just a few. Can add a global config to allow them to change the settings at all

@davidjumani it would be good to have allow list or deny list.

[davidjumani]

@weizhouapache I'll make the changes with an allow list. Would it be better to have a single list or individual ones for domain and account level settings ?

[ravening]

@davidjumani @weizhouapache will this pr conflict with #4215 ?
Currently all the account settings are not visible under domain. The above pr adds a global setting so that it makes account settings visible under domain level

[davidjumani]

@ravening This shouldn't since this allows domain admins to modify domain / account settings

[yadvr]

@nvazquez @sureshanaparti @davidjumani @shwstppr @Pearl1594 @DaanHoogland @weizhouapache - any update on this, who's assigned/working on this? Thanks.

[Pearl1594]

There already seems to be a PR in its favor: #4339 @rhtyd