openstack/barbican
Code Issues Proposed changes

Use authorize instead of enforce for policy

Browse Source 
The authorize function actually checks that the policy we're evaluating
has been registered. Since we do use policy-as-code, we can safely use
this method which is preferred.

Change-Id: I429e56c51f08ad3856f8822479747410c417b9a9
This commit is contained in:
Juan Antonio Osorio Robles 2018-11-07 15:32:46 +02:00
parent 14bfdc49d5
commit 1aaf326e1d
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
barbican/api/controllers/__init__.py
View File

@ -61,8 +61,8 @@ def _do_enforce_rbac(inst, req, action_name, ctx, **kwargs):
policy_dict.update(kwargs)
# Enforce access controls.
if ctx.policy_enforcer:
ctx.policy_enforcer.enforce(action_name, flatten(policy_dict),
ctx, do_raise=True)
ctx.policy_enforcer.authorize(action_name, flatten(policy_dict),
ctx, do_raise=True)
def enforce_rbac(action_name='default'):

2
barbican/tests/api/test_transport_keys_resource.py
View File

@ -33,7 +33,7 @@ from barbican.tests import utils
def get_barbican_env(external_project_id):
class NoopPolicyEnforcer(object):
def enforce(self, *args, **kwargs):
def authorize(self, *args, **kwargs):
return
kwargs = {'roles': None,