yahoo-eng-team team mailing list archive

[Morgan Fainberg <morgan.fainberg@xxxxxxxxx>]

** Also affects: keystone/juno
   Importance: Undecided
       Status: New

** Changed in: keystone/juno
   Importance: Undecided => High

** Changed in: keystone/juno
     Assignee: (unassigned) => Brant Knudson (blk-u)

** Changed in: keystone/juno
       Status: New => In Progress

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1385533

Title:
  Domain tokens issued from a saml2 auth incorrectly includes group
  roles marked as inherited

Status in OpenStack Identity (Keystone):
  Fix Released
Status in Keystone juno series:
  In Progress

Bug description:
  When building the roles in a Keystone  token from a saml2 token, we
  call assignment_api.get_roles_for_groups() to add in any group roles.
  This appears to ignore the inheritance flag on the assignment - and
  puts in all group roles whether inherited or not.  This means the
  wrong roles can end up in the resulting Keystone token.

  The implication is that domain scoped tokens would incorrectly get
  roles that were meant to be inherited (only) to projects within that
  domain.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1385533/+subscriptions