[DaanHoogland]

Description

This PR allows domain admins to add LDAP users to accounts in their domain.

• ldapCreateAccount and importLdapUsers are now authorized for Admin and DomainAdmin.
• @APICommand(authorized=...) on its own does not grant access under dynamic RBAC (the default), so the 4.23 → 24.0 upgrade script (schema-42300to2400.sql) backfills listLdapUsers, ldapCreateAccount, linkAccountToLdap and importLdapUsers role permissions for every role that already has createAccount, with the same permission and sort order.
• UI: the "Add LDAP Account" action is shown only when isLdapEnabled is set. That flag came from listLdapConfigurations called without parameters, which returns only global LDAP configurations (domain_id IS NULL). When the only LDAP configuration was linked to a domain, the button was hidden for every role. The check now depends on the logged-in user: for root admins, any configuration counts (listall=true); for everyone else, a global configuration or one linked to their own domain counts.

Fixes: #3687

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

How Has This Been Tested?

• @kiranchavala tested the packaged build (SL-JID 19160): with a global LDAP configuration, a domain admin sees and can use "Add LDAP Account". With a configuration linked to a domain, the button was hidden. The UI change above fixes that case.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 20.78%. Comparing base (f00e0c7) to head (a096613).

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #13952   +/-   ##
=========================================
  Coverage     20.77%   20.78%           
- Complexity    21926    21928    +2     
=========================================
  Files          6496     6496           
  Lines        591630   591628    -2     
  Branches      72591    72591           
=========================================
+ Hits         122932   122942   +10     
+ Misses       455352   455342   -10     
+ Partials      13346    13344    -2     

Flag	Coverage Δ
uitests	3.88% <ø> (+<0.01%)	⬆️
unittests	22.09% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🔴 Test Coverage Grade: D — Marginal

Metric	Value
Line coverage	25.89%
Branch coverage	20.22%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[kiranchavala]

@blueorangutan package

[blueorangutan]

@kiranchavala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19160

[kiranchavala]

@DaanHoogland

When Ldap configuration is linked to a domain , the add LDAP account button is not visible in the UI when domain admin is logged in

[root@ref-trl-12338-k-Mol8-kiran-chavala-mgmt1 ~]# cmk list ldapconfigurations listall=true
Loaded in-built API cache. Failed to read API cache, please run 'sync'.
{
  "LdapConfiguration": [
    {
      "domainid": "15151f02-0d6a-401c-bc9f-35c31712bee1",
      "hostname": "10.0.33.32",
      "id": "edd0c804-4b82-4e4e-b500-2725325f8d52",
      "port": 389
    }
  ],
  "count": 1
}

When the ldap configuration is not linked to any domain , then the add LDAP account is visible in the UI when domain admin is logged in

[root@ref-trl-12338-k-Mol8-kiran-chavala-mgmt1 ~]# cmk list ldapconfigurations listall=true
Loaded in-built API cache. Failed to read API cache, please run 'sync'.
{
  "LdapConfiguration": [
    {
      "hostname": "10.0.33.32",
      "id": "7137bdff-db71-4495-968f-58476ddf68d3",
      "port": 389
    }
  ],
  "count": 1
}

[kiranchavala]

@DaanHoogland AI suggestion

The chain

The button's only gate is store.isLdapEnabled (ui/src/config/section/account.js:119-121), and that flag is computed in ui/src/store/modules/user.js:493-495:

getAPI('listLdapConfigurations').then(response => {
  const ldapEnable = (response.ldapconfigurationresponse.count > 0)
  commit('SET_LDAP', ldapEnable)
})

Called with no parameters — so no domainid, and listall defaults to false. That lands in LdapConfigurationDaoImpl.getSearchCriteria() (lines 83-97):

} else if (domainId != null) {   // not our case
} else if (listAll) {            // not our case
} else {
    sc = listGlobalConfigurationsSearch.create();   // ← this one
}

and listGlobalConfigurationsSearch hard-filters on domain_id IS NULL (line 47):

listGlobalConfigurationsSearch.and("domain_id", ...getDomainId(), SearchCriteria.Op.NULL);

So a configuration linked to a domain has domain_id set, is excluded, count = 0, isLdapEnabled = false, and the "Add LDAP Account" action is hidden. Note this is role-independent — it hides the button for root admin too, not just domain admins.

[nvazquez]

Hi @DaanHoogland is this PR ready for review or is it still in progress? Should it be targeted for 24.0?

[DaanHoogland]

Hi @DaanHoogland is this PR ready for review or is it still in progress? Should it be targeted for 24.0?

@nvazquez , now it is.

[DaanHoogland]

@blueorangutan ui

[blueorangutan]

@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

[blueorangutan]

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[blueorangutan]

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/13952 (QA-JID-1008)

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19880

[DaanHoogland]

@blueorangutan package

[blueorangutan]

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19898

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud