[GitHub] [trafficcontrol] srijeet0406 commented on pull request #6761: Add "sharing" ability to CDN locks

[GitBox <gi...@apache.org>]

srijeet0406 commented on PR #6761:
URL: https://github.com/apache/trafficcontrol/pull/6761#issuecomment-1105810919

   > I am seeing an issue where I cannot always share a lock with an existing user. Is there something I am missing?
   > 
   > I am logged in as admin and have these users available (some I created): ![Screen Shot 2022-04-21 at 11 03 56 AM](https://user-images.githubusercontent.com/14004132/164513721-7a2f045a-b93e-44a4-ba42-2ca8ffc11055.png)
   > 
   > However when I try creating a lock with one of the users listed above, using my admin account, (on TO or TP) Example:
   > 
   > ```json
   > {
   >     "cdn": "CDN-in-a-Box",
   >     "message": "test",
   >     "soft": true,
   >     "sharedUserNames": ["tenant2"]
   > }
   > ```
   > 
   > The response returned (or TP Alert):
   > 
   > ```json
   > {
   >     "alerts": [
   >         {
   >             "text": "shared users must exist and be in the same/child tenants of the current user",
   >             "level": "error"
   >         }
   >     ]
   > }
   > ```
   > 
   > The tenant2 user clearly exists and is a child tenant of root. This also happens with the "readonly" user which has the same tenancy as admin: root. Is there a certain rule or something else I might be missing?
   
   Ok so the `read-only` role user will not be able to create locks because it doesn't have the `CDN-LOCK:CREATE` permission. I'll add a more informative error message for that use case. I'm looking into the other issue where a user cannot share their lock with a child tenant user.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org