yahoo-eng-team team mailing list archive
-
yahoo-eng-team team
-
Mailing list archive
-
Message #76927
[Bug 1815539] [NEW] Self-service policies for credential APIs are boken in stable/rocky
Public bug reported:
Service-service policies for credential APIs are broken in stable/rocky.
More specifically, Get/Update/Delete no longer works with the following
policies.
"identity:get_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
"identity:update_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
"identity:delete_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
This used to work in Pike and Queens because we pass the entity to
policy enforcement via get_member_from_driver.
https://github.com/openstack/keystone/blob/stable/queens/keystone/credential/controllers.py#L36
However, in stable/rocky we no longer pass the entity as part of the
target.
https://github.com/openstack/keystone/blob/stable/rocky/keystone/api/credentials.py#L86
Therefore, any policy rule which has target.credential.* no longer
works.
Stein seems to be working again as the problem was fixed as part of
https://bugs.launchpad.net/keystone/+bug/1788415.
We'll need to fix stable/rocky by conveying the credential entity to the
target again.
** Affects: keystone
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1815539
Title:
Self-service policies for credential APIs are boken in stable/rocky
Status in OpenStack Identity (keystone):
New
Bug description:
Service-service policies for credential APIs are broken in
stable/rocky. More specifically, Get/Update/Delete no longer works
with the following policies.
"identity:get_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
"identity:update_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
"identity:delete_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
This used to work in Pike and Queens because we pass the entity to
policy enforcement via get_member_from_driver.
https://github.com/openstack/keystone/blob/stable/queens/keystone/credential/controllers.py#L36
However, in stable/rocky we no longer pass the entity as part of the
target.
https://github.com/openstack/keystone/blob/stable/rocky/keystone/api/credentials.py#L86
Therefore, any policy rule which has target.credential.* no longer
works.
Stein seems to be working again as the problem was fixed as part of
https://bugs.launchpad.net/keystone/+bug/1788415.
We'll need to fix stable/rocky by conveying the credential entity to
the target again.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1815539/+subscriptions
Follow ups