OpenStack Identity (keystone)

domain admin unable to setup a domain-specific role to imply another domain-specific role in the same domain

Bug #1593813 reported by Guang Yee
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
Medium
Sean Perry
OpenStack Identity (keystone) ocata-1 "o1"

Bug Description

With policy.v3cloudsample.json, domain admin of a domain is unable to setup a prior domain-specific role to imply another domain-specific role in the same domain. Per design, this is allowed.

To reproduce.

1. Create "DomainA"
2. Create domain user "foo" in "DomainA"
3. Make "foo" the domain admin of "DomainA"
4. Get a DA token for "foo"
5. As DA, create a domain-specific role "AppDev" in "DomainA"
6. As DA, create a domain-specific role "AppAdmin" in "DomainA"
7. As DA, try to make "AppAdmin" imples "AppDev" and prepare to receive a HTTP 403 response

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to keystone (master)

Related fix proposed to branch: master
Review: https://review.openstack.org/339558

David Stanek (dstanek)
Changed in keystone:
status: New → Confirmed
summary: - domain admin unable to setup a prior domain-specific role to implied
- another domain-specific role in the same domain
+ domain admin unable to setup a domain-specific role to imply another
+ domain-specific role in the same domain
Revision history for this message
David Stanek (dstanek) wrote :

In our policy.v3cloudsample.json we have this entry which prevents adding an implied role by a domain admin:

    "identity:create_implied_role": "rule:cloud_admin",

Steve Martinelli (stevemar)
Changed in keystone:
importance: Undecided → Medium
milestone: none → newton-3
Steve Martinelli (stevemar)
Changed in keystone:
milestone: newton-3 → none
Sean Perry (sean-perry-a)
Changed in keystone:
assignee: nobody → Sean Perry (sean-perry-a)
OpenStack Infra (hudson-openstack)
Changed in keystone:
status: Confirmed → In Progress
Steve Martinelli (stevemar)
Changed in keystone:
milestone: none → ocata-1
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/339558
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=47d4d08ecb6804841d6de640afed8ca743f254b3
Submitter: Jenkins
Branch: master

commit 47d4d08ecb6804841d6de640afed8ca743f254b3
Author: Sean Perry <email address hidden>
Date: Thu Sep 15 11:04:14 2016 -0700

    Give domain admin rights to domain specific implied roles

    Currently this is not working because of our default
    policy.v3cloudsample.json file. Add a new rule to check that the prior
    role's domain ID matches the domain ID of the user.

    Co-Authored-By: David Stanek <email address hidden>
    Change-Id: Id1f5ccac3c639a44b33780b001e401bab195d8b3
    Closes-Bug: #1593813

Changed in keystone:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/keystone 11.0.0.0b1

This issue was fixed in the openstack/keystone 11.0.0.0b1 development milestone.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.