fix:admin with no backend role on AOS unable to create restricted model group (#1188) (#1218)

ylwu-amzn · rbhavna · web-flow · commit c93005fb91cd · 2023-08-18T11:04:13.000-07:00
Signed-off-by: Bhavana Ramaram &lt;rbhavna@amazon.com&gt;
Co-authored-by: Bhavana Ramaram &lt;rbhavna@amazon.com&gt;
diff --git a/plugin/src/main/java/org/opensearch/ml/model/MLModelGroupManager.java b/plugin/src/main/java/org/opensearch/ml/model/MLModelGroupManager.java
@@ -167,7 +167,7 @@ private void validateRequestForAccessControl(MLRegisterModelGroupInput input, Us
             if (modelAccessControlHelper.isAdmin(user) && Boolean.TRUE.equals(isAddAllBackendRoles)) {
                 throw new IllegalArgumentException("Admin users cannot add all backend roles to a model group.");
             }
-            if (CollectionUtils.isEmpty(user.getBackendRoles())) {
+            if (!modelAccessControlHelper.isAdmin(user) && CollectionUtils.isEmpty(user.getBackendRoles())) {
                 throw new IllegalArgumentException("You must have at least one backend role to register a restricted model group.");
             }
             if (CollectionUtils.isEmpty(input.getBackendRoles()) && !Boolean.TRUE.equals(isAddAllBackendRoles)) {

Original file line number	Diff line number	Diff line change
`@@ -167,7 +167,7 @@ private void validateRequestForAccessControl(MLRegisterModelGroupInput input, Us`
`167`	`167`	`if (modelAccessControlHelper.isAdmin(user) && Boolean.TRUE.equals(isAddAllBackendRoles)) {`
`168`	`168`	`throw new IllegalArgumentException("Admin users cannot add all backend roles to a model group.");`
`169`	`169`	`}`
`170`		`- if (CollectionUtils.isEmpty(user.getBackendRoles())) {`
	`170`	`+ if (!modelAccessControlHelper.isAdmin(user) && CollectionUtils.isEmpty(user.getBackendRoles())) {`
`171`	`171`	`throw new IllegalArgumentException("You must have at least one backend role to register a restricted model group.");`
`172`	`172`	`}`
`173`	`173`	`if (CollectionUtils.isEmpty(input.getBackendRoles()) && !Boolean.TRUE.equals(isAddAllBackendRoles)) {`