list users in group unauthorised with v3 policy
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| OpenStack Identity (keystone) |
Fix Released
|
Medium
|
Unassigned | ||
Bug Description
Two identity api have unauthorised issue with v3 policy. They are list_users_in_group and list_groups_
The domain admin should have permission to call these two api, but failed.
Repo Step:
* use v3 policy as config
1. Create domain
2. Create admin user 'userA' under domain (assign admin role to the user with domain scope)
3. Create a normal domain user 'userB' (with domain admin userA's token)
4. Create a normal domain group 'groupB' (with domain admin userA's token)
5. Add userB a member in groupB (with domain admin userA's token)
6. list_users_in_group with groupB's id as param (with domain admin userA's token), unauthorized
7. list_groups_
Both step 6 and step 7 use the domain token.
| Henry Nash (henry-nash) wrote | #1 |
| Changed in keystone: | |
| status: | New → Incomplete |
| Changed in keystone: | |
| status: | Incomplete → New |
| Yi Shi (yi-shi) wrote | #3 |
| Guang Yee (guang-yee) wrote | #4 |
| Lin Hua Cheng (lin-hua-cheng) wrote | #5 |
| Changed in keystone: | |
| importance: | Undecided → Medium |
| status: | New → Confirmed |
| status: | Confirmed → Triaged |
| status: | Triaged → Confirmed |
| Changed in keystone: | |
| assignee: | nobody → Deepti Ramakrishna (dramakri) |
| Kent Wang (k.wang) wrote | #6 |
| Deepti Ramakrishna (dramakri) wrote | #7 |
| Changed in keystone: | |
| assignee: | Deepti Ramakrishna (dramakri) → nobody |
| Changed in keystone: | |
| assignee: | nobody → Kent Wang (k.wang) |
| Steve Martinelli (stevemar) wrote | #8 |
| Changed in keystone: | |
| assignee: | Kent Wang (k.wang) → nobody |
| Changed in keystone: | |
| assignee: | nobody → Deliang Fan (vanderliang) |
| Navid Pustchi (npustchi) wrote | #9 |
| Deliang Fan (vanderliang) wrote | #10 |
| Changed in keystone: | |
| status: | Confirmed → In Progress |
| Changed in keystone: | |
| assignee: | Deliang Fan (vanderliang) → yangweiwei (496176919-6) |
| assignee: | yangweiwei (496176919-6) → nobody |
| Changed in keystone: | |
| assignee: | nobody → Rudolf Vriend (rudolf-vriend) |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to keystone (master) | #11 |
| OpenStack Infra (hudson-openstack) wrote Fix merged to keystone (master) | #12 |
| Changed in keystone: | |
| status: | In Progress → Fix Released |
| Davanum Srinivas (DIMS) (dims-v) wrote Fix included in openstack/keystone 10.0.0.0b2 | #13 |
| Changed in keystone: | |
| milestone: | none → newton-2 |
When you say "with domain admin userA's token" in step 6 (and 7), is this a project token or a domain token?