openstack/charm-keystone
Code Issues Proposed changes

policy: correct domain_id match for admin_and_matching_domain_id

Browse Source 
Ensure that the 'admin_and_matching_domain_id' rule correct
matches to the target.domain_id field, ensuring that domain
admins can actually query user and projects within a domain.

Change-Id: I4c000363dd7746f401613d99210e8ca12f34b010
Closes-Bug: 1830076
This commit is contained in:
James Page 2021-06-15 16:12:02 +01:00
parent 839608f381
commit cef78d47fb
5 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
templates/mitaka/policy.json
View File

@ -10,7 +10,7 @@
"service_or_admin": "rule:admin_required or rule:service_role",
"owner" : "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
"admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(target.domain_id)s",
"service_admin_or_owner": "rule:service_or_admin or rule:owner",
"default": "rule:admin_required",

2
templates/newton/policy.json
View File

@ -10,7 +10,7 @@
"service_or_admin": "rule:admin_required or rule:service_role",
"owner" : "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
"admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(target.domain_id)s",
"service_admin_or_owner": "rule:service_or_admin or rule:owner",
"default": "rule:admin_required",

2
templates/ocata/policy.json
View File

@ -10,7 +10,7 @@
"service_or_admin": "rule:admin_required or rule:service_role",
"owner" : "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
"admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(target.domain_id)s",
"service_admin_or_owner": "rule:service_or_admin or rule:owner",
"default": "rule:admin_required",

2
templates/queens/policy.json
View File

@ -5,7 +5,7 @@
"service_or_admin": "rule:admin_required or rule:service_role",
"owner": "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
"admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(target.domain_id)s",
"service_admin_or_owner": "rule:service_or_admin or rule:owner",
"default": "rule:admin_required",

2
templates/rocky/policy.json
View File

@ -5,7 +5,7 @@
"service_or_admin": "rule:admin_required or rule:service_role",
"owner": "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
"admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(target.domain_id)s",
"service_admin_or_owner": "rule:service_or_admin or rule:owner",
"default": "rule:admin_required",