Zones listing filtering is not being applied for dedicated domains

[nvazquez]

problem

When creating a ResourceAdmin account with special listing permissions on a domain with a dedicated zone, CloudStack is listing all the zones on the environment, instead of filtering them by domain and listing only the zone dedicated to this domain.

This behaviour is only affecting zones listing, filtering is applied for pods and clusters and CloudStack is filtering them by the domain, excluding the rest of non-dedicated pods or clusters for that domain.

versions

ACS 4.18 onwards

The steps to reproduce the bug

1. Create a new zone and a new domain, dedicate the zone to the domain
2. Create a new role based on the role = ResourceAdmin, and give them Allow permissions for these APIs: addCluster, listDedicatedZones, listDedicatedPods, listDedicatedClusters, listDedicatedHosts, listDedicatedGuestVlanRanges, listInfrastructure, listZonesMetrics, listClustersMetrics, listHostsMetrics, dedicateCluster
   (listInfrastructure API is needed for the user to see the Infrastructure tab in the UI, similarly listZonesMetrics, listClustersMetrics, listHostsMetrics to see zones, clusters and hosts within Infrastructure)
3. Create an account on the domain using the new role and log in

Limitations:

• I was able to list zones, however CloudStack is not filtering the zones and is displaying also the non-dedicated zones for the user, which should not be visible.
• I was able to add a cluster on the dedicated zone, by choosing the correct zone on the add cluster wizard. Ideally CloudStack should have only listed the dedicated zone (same for hosts).

What to do about it?

No response

[DaanHoogland]

2. Create a new role based on the type = ResourceAdmin,

I noted this cannot be done in the UI. You’ll need to use the API for create role with type.

[nvazquez]

Typo fixed, meant to write Role = ResourceAdmin

[DaanHoogland]

after some backroom talk: the idea is to create a setting that will allow (by default) any kind of user to view/list all zones when they are part of a domain that has dedicated resources. When this setting is switched, only resources that are dedicated to them will be shown.

@rajujith @rohityadavcloud @nvazquez , I will extend #11087 with such a setting.