Re: [openstack-dev] [Keystone] policy has no effect because of hard coded assert_admin?

2013-12-13 Thread Dolph Mathews
On Thu, Dec 12, 2013 at 11:03 PM, Qiu Yu wrote: > On Fri, Dec 13, 2013 at 2:40 AM, Morgan Fainberg wrote: > >> As Dolph stated, V3 is where the policy file protects. This is one of >> the many reasons why I would encourage movement to using V3 Keystone over >> V2. >> >> The V2 API is officially

Re: [openstack-dev] [Keystone] policy has no effect because of hard coded assert_admin?

2013-12-12 Thread Qiu Yu
On Fri, Dec 13, 2013 at 2:40 AM, Morgan Fainberg wrote: > As Dolph stated, V3 is where the policy file protects. This is one of the > many reasons why I would encourage movement to using V3 Keystone over V2. > > The V2 API is officially deprecated in the Icehouse cycle, I think that > moving the

Re: [openstack-dev] [Keystone] policy has no effect because of hard coded assert_admin?

2013-12-12 Thread Dolph Mathews
On Thu, Dec 12, 2013 at 12:40 PM, Morgan Fainberg wrote: > As Dolph stated, V3 is where the policy file protects. This is one of the > many reasons why I would encourage movement to using V3 Keystone over V2. > > The V2 API is officially deprecated in the Icehouse cycle, I think that > moving th

Re: [openstack-dev] [Keystone] policy has no effect because of hard coded assert_admin?

2013-12-12 Thread Morgan Fainberg
As Dolph stated, V3 is where the policy file protects.  This is one of the many reasons why I would encourage movement to using V3 Keystone over V2. The V2 API is officially deprecated in the Icehouse cycle, I think that moving the decorator potentially could cause more issues than not as stated

Re: [openstack-dev] [Keystone] policy has no effect because of hard coded assert_admin?

2013-12-12 Thread Dolph Mathews
The policy file is protecting v3 API calls at the controller layer, but you're calling the v2 API. The policy decorators should be moved to the manager layer to protect both APIs equally... but we'd have to be very careful not to break deployments depending on the trivial "assert_admin" behavior (h