Mailing-List: contact issues-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Date: Fri, 20 Nov 2015 09:54:10 +0000 (UTC)
From: "ASF GitHub Bot (JIRA)" <jira@apache.org>
To: cloudstack-issues@incubator.apache.org
Message-ID: <JIRA.12703138.1395646953000.135750.1448013250982@Atlassian.JIRA>
In-Reply-To: <JIRA.12703138.1395646953000@Atlassian.JIRA>
References: <JIRA.12703138.1395646953000@Atlassian.JIRA>
 <JIRA.12703138.1395646953064@arcas>
Subject: [jira] [Commented] (CLOUDSTACK-6276) Affinity Groups within
 projects
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/CLOUDSTACK-6276?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15015521#comment-15015521 ] 

ASF GitHub Bot commented on CLOUDSTACK-6276:
--------------------------------------------

Github user ustcweizhou commented on the pull request:

    https://github.com/apache/cloudstack/pull/508#issuecomment-158342455
  
    @pdube 
    you may notice this code in UserVmManagerImpl.java
    _accountMgr.checkAccess(caller, null, true, owner, ag);
    
    normally it will check
    (1) caller can access owner
    (2) caller can access/modify ag (affinity group)
    (3) The account of owner and ag are the same.
    
    I guess you have modified the account of ag (when create an affinity group from project view) from account to project account of project. If yes, the (2) will fail, because affinity group has special AccessChecker that the caller can only be the account of the affinity group. However, when we log in as Account A and go to Project view, the call is A, not the project account of the project.
    
    Do you need my help to fix the issues or test the changes ?
    
    
> Affinity Groups within projects
> -------------------------------
>
>                 Key: CLOUDSTACK-6276
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-6276
>             Project: CloudStack
>          Issue Type: New Feature
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Management Server
>            Reporter: Ingo Jochim
>
> Hello,
> I like to have the features "Affinity Group" and "Project" combined.
> As far as I know I cannot use Affinity Groups within Projects.
> Thanks and regards,
> Ingo


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)