yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: keystone
       Status: Fix Committed => Fix Released

** Changed in: keystone
    Milestone: None => icehouse-3

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1267187

Title:
  Keystone policy.v3cloudsample.json doesn't allow proper resources
  management

Status in OpenStack Identity (Keystone):
  Fix Released

Bug description:
  When using the current `̀ etc/policy.v3cloudsample.json`` file as
  Keystone's ``/etc/keystone/policy.json`` file (with `̀
  admin_domain_id`` properly configured), the following issues arise:

  * The cloud_admin user cannot manage users in other domains that the `̀
    cloud`` domain. For instance, once the cloud_admin created a brand
    new domain, he cannot create a user in this domain.

  * The cloud_admin cannot manage roles on other domains that the `̀
    cloud`̀  domain. For instance, if the cloud_admin managed to create a
    domain and a user in this new domain, he cannot grant the `admin`
    role on the domain to this new user.

  * A domain administrator (user with the ``admin`` role on the domain)
    cannot manage roles on projects in its own domain. For instance, a
    domain administrator can create a project and a user in his domain,
    but he cannot grant the Member role on the project to the new user.

  With the following additional rules, one would have an operational
  Identity v3 API enabled setting:

  * The cloud_admin should be allowed to manage users in any domain.

  * The cloud_admin should be allowed to manage roles on any domain.

  * Domain administrators should be allowed to manage roles on any
    project in their own domain.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1267187/+subscriptions