yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: keystone
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1417522

Title:
  a normal user can delete other user's ec2 credentials

Status in OpenStack Identity (Keystone):
  Fix Released

Bug description:
  When use default policy.v3cloudsample.json, a normal user can delete
  other user's ec2 credential. This is because current policy of
  identity:ec2_delete_credential is (rule:admin_or_cloud_admin or
  rule:owner) or (rule:owner and user_id:%(target.credential.user_id)s).
  Note that rule:owner is "user_id:%(user_id)s or
  user_id:%(target.token.user_id)s" which only checks if the user from
  token matchs the user from url. We also should check if the user owns
  the deleting credential.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1417522/+subscriptions