yahoo-eng-team team mailing list archive

[Dolph Mathews <1267215@xxxxxxxxxxxxxxxxxx>]

As of keystone stable/havana 2013.2.2 (commit
0d83e7eee20a50a75863a9d3c75aee7030518229), this doesn't appear to be an
issue. I attempted to reproduce with:

$ python -c "import json; print
json.dumps(json.loads(open('etc/policy.v3cloudsample.json').read()),
indent=2)"

But got pretty-printed JSON as expected:

{
  "identity:list_endpoints": [
    [
      "rule:admin_or_cloud_admin"
    ]
  ], 
  "identity:delete_role": [
    [
      "rule:cloud_admin"
    ]
  ],
 <snipped>
}

** Also affects: keystone/havana
   Importance: Undecided
       Status: New

** Changed in: keystone
       Status: New => Invalid

** Changed in: keystone/havana
       Status: New => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1267215

Title:
  policy.v3cloudsample.json contains unparsable items

Status in OpenStack Identity (Keystone):
  Invalid
Status in Keystone havana series:
  Invalid

Bug description:
  havana policy.v3cloudsample.json file containts something that can't be parsed.  Keystone logs 'Can't load the rule' (or something similar) filing on split(':')
      "identity:list_role_assignments": [["admin_on_domain_filter"],
                                         ["admin_on_project_filter"]],

  I guess it should be 
      "identity:list_role_assignments": [["rule:admin_on_domain_filter"],
                                         ["rule:admin_on_project_filter"]],

  Also I found that I was hardly able work with grants for projects  inside not default domain.
  I solved it by changing the rules (probably ones provided in sample policy.json also can be changed):
     "admin_on_domain_target" : [["rule:admin_required", "domain_id:%(target.domain.id)s"]],
      "admin_on_project_target" : [["rule:admin_required", "project_id:%(target.project.id)s"]],
      "identity:check_grant": [["rule:admin_on_project_target"],
                               ["rule:admin_on_domain_target"]],
      "identity:list_grants": [["rule:admin_on_project_target"],
                               ["rule:admin_on_domain_target"]],
      "identity:create_grant": [["rule:admin_on_project_target"],
                                ["rule:admin_on_domain_target"]],
      "identity:revoke_grant": [["rule:admin_on_project_target"],
                                ["rule:admin_on_domain_target"]],

  to
      "admin_on_project_target" : [["rule:admin_required", "project_id:%(target.project.id)s"]],
      "admin_on_project_domain_target" : [["rule:admin_required", "domain_id:%(target.project.domain_id)s"]],
      "grant_admin" : [["rule:admin_on_project_target"],
                       ["rule:admin_on_project_domain_target"]],
      "identity:check_grant": [["rule:grant_admin"]],
      "identity:list_grants": [["rule:grant_admin"]],
      "identity:create_grant": [["rule:grant_admin"]],
      "identity:revoke_grant": [["rule:grant_admin"]],

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1267215/+subscriptions