EvmRole-reader access to reports

[jaywcarman]

I have a set of users that I want to grant read-only access to reports, dashboards and provider resources. The out-of-box EvmGroup-reader group (which is assigned to the EvmRole-reader role) is almost exactly what I need. It is missing access to read reports.

The EvmRole-reader role only allows access to reports that the user owns. Since the EvmRole-reader role does not allow running reports, the user will not own any reports (unless the user creates reports while a member of another group/role).

If I create a custom role that is EvmRole-reader + miq_report_superadmin then I get exactly what I need: Read access to all reports, dashboards and provider resources.

Creating a new role/group is enough so this is perfectly fine. My question here is: is it intentional to omit read access to reports in the EvmRole-reader role? The miq_report_superadmin feature sounds scary (... superadmin !) but as far as I can tell it's just read access. Perhaps it would make sense to add it to the default feature set for EvmRole-reader.

[Fryguy]

The EvmRole reader was added as a way to have a fully read-only account (See original PR #15647). It seems even then that reports were called out, but then the PR was merged anyway. I suspect that they realized that report-superadmin was the only was to add it and then left it out, but never went back to fix it.

To me, this sound like we need to include miq_report_view and miq_report_saved_reports_view, and if those aren't working with read-only mode, then we need to update the code to support that.

[jaywcarman]

Both miq_report_view and miq_report_saved_reports_view are already included in the EvmRole-reader and working as expected.

Since reports can be assigned to a user or group it makes sense for access to rbac to always be enforced.

But as far as I can tell there is no way to set user/group ownership of a report - it's automatically assigned to the user/group who created it. This prevents a report admin from creating common reports and sharing with EvmRole-reader users. I can open an enhancement issue for this.