Reviewed: https://review.opendev.org/677580 Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=ab0e96df9506fb6f1783e0ee79b63934dabe0cbe Submitter: Zuul Branch: master
commit ab0e96df9506fb6f1783e0ee79b63934dabe0cbe Author: Gloria Gu <[email protected]> Date: Tue Aug 20 15:45:22 2019 -0700 Avoid forced logout when 403 error encountered Before this change when a 403 error was encountered, such as failure to have the permission to perform an operation, the user would get logged out from UI pages written in the AngularJS framework. For example, if an admin user lacks the get_project permission and tries to access the images page, project->compute->images, the 403 will forcibly log out the user. This change keeps the user logged in when a 403 error is encountered and displays an error message. The change only affects AngularJS pages. Change-Id: I10a6eeb96dd1418449e1d15b1a3869cd4de9cafa Closes-bug: #1840844 ** Changed in: horizon Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Dashboard (Horizon). https://bugs.launchpad.net/bugs/1840844 Title: user with admin role gets logged out when trying to list images Status in OpenStack Dashboard (Horizon): Fix Released Bug description: When admin user tries to access project-> compute -> images, if the user failed on the identity: get_project policy, user will get logged out. code that failed is in openstack_dashboard/static/app/core/images/images.module.js .tableColumns .append( { id: 'owner', priority: 1, filters: [$memoize(keystone.getProjectName)], policies: [ {rules: [['identity', 'identity:get_project']]} ] }) it didn't happen in default Horizon. In our production cloud environment, keystone policy is "identity:get_project": "rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s". If user is not a cloud_admin, the admin user of a project, need to be member of the domain to satisfies the rule. The problem here is the admin user should not get logged out. It is probably caused by horizon/static/framework/framework.module.js if (error.status === 403) { var msg2 = gettext('Forbidden. Redirecting to login'); handleRedirectMessage(msg2, $rootScope, $window, frameworkEvents, toastService); } some log info from keystone 19389 (oslo_policy._cache_handler): 2019-08-20 02:07:25,856 DEBUG _cache_handler read_cached_file Reloading cached file /etc/keystone/policy.json 19389 (oslo_policy.policy): 2019-08-20 02:07:26,010 DEBUG policy _load_policy_file Reloaded policy file: /etc/keystone/policy.json 19389 (keystone.common.wsgi): 2019-08-20 02:07:26,019 WARNING wsgi _call_ You are not authorized to perform the requested action: identity:get_project. To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1840844/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : [email protected] Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
