Public bug reported: Service-service policies for credential APIs are broken in stable/rocky. More specifically, Get/Update/Delete no longer works with the following policies.
"identity:get_credential": "rule:admin_required or user_id:%(target.credential.user_id)s" "identity:update_credential": "rule:admin_required or user_id:%(target.credential.user_id)s" "identity:delete_credential": "rule:admin_required or user_id:%(target.credential.user_id)s" This used to work in Pike and Queens because we pass the entity to policy enforcement via get_member_from_driver. https://github.com/openstack/keystone/blob/stable/queens/keystone/credential/controllers.py#L36 However, in stable/rocky we no longer pass the entity as part of the target. https://github.com/openstack/keystone/blob/stable/rocky/keystone/api/credentials.py#L86 Therefore, any policy rule which has target.credential.* no longer works. Stein seems to be working again as the problem was fixed as part of https://bugs.launchpad.net/keystone/+bug/1788415. We'll need to fix stable/rocky by conveying the credential entity to the target again. ** Affects: keystone Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1815539 Title: Self-service policies for credential APIs are boken in stable/rocky Status in OpenStack Identity (keystone): New Bug description: Service-service policies for credential APIs are broken in stable/rocky. More specifically, Get/Update/Delete no longer works with the following policies. "identity:get_credential": "rule:admin_required or user_id:%(target.credential.user_id)s" "identity:update_credential": "rule:admin_required or user_id:%(target.credential.user_id)s" "identity:delete_credential": "rule:admin_required or user_id:%(target.credential.user_id)s" This used to work in Pike and Queens because we pass the entity to policy enforcement via get_member_from_driver. https://github.com/openstack/keystone/blob/stable/queens/keystone/credential/controllers.py#L36 However, in stable/rocky we no longer pass the entity as part of the target. https://github.com/openstack/keystone/blob/stable/rocky/keystone/api/credentials.py#L86 Therefore, any policy rule which has target.credential.* no longer works. Stein seems to be working again as the problem was fixed as part of https://bugs.launchpad.net/keystone/+bug/1788415. We'll need to fix stable/rocky by conveying the credential entity to the target again. To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1815539/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : [email protected] Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
