UI: a role denied one non-essential bootstrap API (e.g. listLdapConfigurations) fails to load the entire console

Open Beginner friendly
#13,912 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
85/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
frontend

Research direction

Start in ui/src/store/modules/user.js at GetInfo, especially listLdapConfigurations and the tolerant listNetworkServiceProviders/listGuiThemes handlers. Check ui/src/permission.js to understand the route guard failure path. Done means a denied non-essential bootstrap read defaults its flag without rejecting GetInfo, so the console loads instead of redirecting to /user/login.

Written by the indexing model from the issue text.

Description

component:UI
problem

The web console fails to load entirely for any role denied one non-essential bootstrap read. GetInfo runs several independent calls under a single shared Promise and wires several to the same reject, including listLdapConfigurations, which only sets a flag. When a role denies it the 432 rejects the shared promise before listApis can resolve it (a race the small query usually wins), so GetInfo rejects and the router guard logs the user out instead of building routes. The tolerant pattern sits right beside it: listNetworkServiceProviders swallows its own error and the console still loads (listGuiThemes likewise).

Expected: a denied non-essential read degrades like listNetworkServiceProviders/listGuiThemes. Actual: blank console, redirect to /user/login.

versions

4.22 and current main. Client-side UI only; hypervisor/storage/network irrelevant.

The steps to reproduce the bug
  1. Create a custom role (e.g. from the DomainAdmin base type) that denies listLdapConfigurations.
  2. Assign an account to it.
  3. Log in to the web UI — the console never renders and you are redirected to login.
What to do about it?

Give listLdapConfigurations (and any non-essential bootstrap read) its own .catch that defaults the flag, as listNetworkServiceProviders already does. The underlying hazard is the shared resolve/reject across independent calls in GetInfo; reserve reject for genuinely essential calls such as listApis.

Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
7d 5h
Merged PRs (30d)
28

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/cloudstack

All issues in apache/cloudstack

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.