yahoo-eng-team team mailing list archive

[Wei Xiaoli <1401040@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

when domain/user was disabled, we still can grant role to user on
domain/project, but doc shows these operations should not be allowed.

see doc: http://docs.openstack.org/api/openstack-identity-service/3/content/domains-v3domains.html
{
...
Setting this attribute to false prevents users from authorizing against this domain or any projects owned by this domain, and prevents users owned by this domain from authenticating or receiving any other authorization. Additionally, all pre-existing tokens applicable to the above entities are immediately invalidated. Re-enabling a domain does not re-enable pre-existing tokens.
}

** Affects: keystone
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1401040

Title:
  documents show we can't grant role to user on domain/project when this
  domain/user was disabled, but we actually do these operation, please
  correct the content of documents.

Status in OpenStack Identity (Keystone):
  New

Bug description:
  when domain/user was disabled, we still can grant role to user on
  domain/project, but doc shows these operations should not be allowed.

  see doc: http://docs.openstack.org/api/openstack-identity-service/3/content/domains-v3domains.html
  {
  ...
  Setting this attribute to false prevents users from authorizing against this domain or any projects owned by this domain, and prevents users owned by this domain from authenticating or receiving any other authorization. Additionally, all pre-existing tokens applicable to the above entities are immediately invalidated. Re-enabling a domain does not re-enable pre-existing tokens.
  }

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1401040/+subscriptions