← Back to team overview

yahoo-eng-team team mailing list archive

[Bug 1815539] [NEW] Self-service policies for credential APIs are boken in stable/rocky

 

Public bug reported:

Service-service policies for credential APIs are broken in stable/rocky.
More specifically, Get/Update/Delete no longer works with the following
policies.

"identity:get_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
"identity:update_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
"identity:delete_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"

This used to work in Pike and Queens because we pass the entity to
policy enforcement via get_member_from_driver.

https://github.com/openstack/keystone/blob/stable/queens/keystone/credential/controllers.py#L36

However, in stable/rocky we no longer pass the entity as part of the
target.

https://github.com/openstack/keystone/blob/stable/rocky/keystone/api/credentials.py#L86

Therefore, any policy rule which has target.credential.* no longer
works.

Stein seems to be working again as the problem was fixed as part of
https://bugs.launchpad.net/keystone/+bug/1788415.

We'll need to fix stable/rocky by conveying the credential entity to the
target again.

** Affects: keystone
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1815539

Title:
  Self-service policies for credential APIs are boken in stable/rocky

Status in OpenStack Identity (keystone):
  New

Bug description:
  Service-service policies for credential APIs are broken in
  stable/rocky. More specifically, Get/Update/Delete no longer works
  with the following policies.

  "identity:get_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
  "identity:update_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"
  "identity:delete_credential": "rule:admin_required or user_id:%(target.credential.user_id)s"

  This used to work in Pike and Queens because we pass the entity to
  policy enforcement via get_member_from_driver.

  https://github.com/openstack/keystone/blob/stable/queens/keystone/credential/controllers.py#L36

  However, in stable/rocky we no longer pass the entity as part of the
  target.

  https://github.com/openstack/keystone/blob/stable/rocky/keystone/api/credentials.py#L86

  Therefore, any policy rule which has target.credential.* no longer
  works.

  Stein seems to be working again as the problem was fixed as part of
  https://bugs.launchpad.net/keystone/+bug/1788415.

  We'll need to fix stable/rocky by conveying the credential entity to
  the target again.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1815539/+subscriptions


Follow ups