f5f42edb26
Recent changes tidied up the v3 sample policy, but unfortunately this introduced a defect that meant a domain admin could create roles on other domains. In addition, in an attempt to simplify the policies, these changes increased the risk of a user being able to spoof the policy by using bogus url options. This patch fixes these issues. Limitations: - The current code + policy does not prevent a domain admin updating the domain_id of a user/group/project to some other domain. Ideally we would prevent this via policy, but this requires an enhancement to our policy engine (to be be able to check for existance of a member in an object). Such a change of domain_id is, with this patch, at least now benign - since if the user acting as domain admin does not have a role on the new domain, then there is nothing they can do. A separate bug (1291393) has been raised for this. Closes-Bug: 1287219 Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5
158 lines
8.8 KiB
JSON
158 lines
8.8 KiB
JSON
{
|
|
"admin_required": "role:admin",
|
|
"cloud_admin": "rule:admin_required and domain_id:admin_domain_id",
|
|
"service_role": "role:service",
|
|
"service_or_admin": "rule:admin_required or rule:service_role",
|
|
"owner" : "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
|
|
"admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner",
|
|
"admin_or_cloud_admin": "rule:admin_required or rule:cloud_admin",
|
|
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
|
|
|
|
"default": "rule:admin_required",
|
|
|
|
"identity:get_region": "",
|
|
"identity:list_regions": "",
|
|
"identity:create_region": "rule:admin_or_cloud_admin",
|
|
"identity:update_region": "rule:admin_or_cloud_admin",
|
|
"identity:delete_region": "rule:admin_or_cloud_admin",
|
|
|
|
"identity:get_service": "rule:admin_or_cloud_admin",
|
|
"identity:list_services": "rule:admin_or_cloud_admin",
|
|
"identity:create_service": "rule:cloud_admin",
|
|
"identity:update_service": "rule:cloud_admin",
|
|
"identity:delete_service": "rule:cloud_admin",
|
|
|
|
"identity:get_endpoint": "rule:admin_or_cloud_admin",
|
|
"identity:list_endpoints": "rule:admin_or_cloud_admin",
|
|
"identity:create_endpoint": "rule:cloud_admin",
|
|
"identity:update_endpoint": "rule:cloud_admin",
|
|
"identity:delete_endpoint": "rule:cloud_admin",
|
|
|
|
"identity:get_domain": "rule:cloud_admin",
|
|
"identity:list_domains": "rule:cloud_admin",
|
|
"identity:create_domain": "rule:cloud_admin",
|
|
"identity:update_domain": "rule:cloud_admin",
|
|
"identity:delete_domain": "rule:cloud_admin",
|
|
|
|
"admin_and_matching_target_project_domain_id": "rule:admin_required and domain_id:%(target.project.domain_id)s",
|
|
"admin_and_matching_project_domain_id": "rule:admin_required and domain_id:%(project.domain_id)s",
|
|
"identity:get_project": "rule:cloud_admin or rule:admin_and_matching_target_project_domain_id",
|
|
"identity:list_projects": "rule:admin_required and domain_id:%(domain_id)s",
|
|
"identity:list_user_projects": "rule:owner or rule:admin_and_matching_domain_id",
|
|
"identity:create_project": "rule:cloud_admin or rule:admin_and_matching_project_domain_id",
|
|
"identity:update_project": "rule:cloud_admin or rule:admin_and_matching_target_project_domain_id",
|
|
"identity:delete_project": "rule:cloud_admin or rule:admin_and_matching_target_project_domain_id",
|
|
|
|
"admin_and_matching_target_user_domain_id": "rule:admin_required and domain_id:%(target.user.domain_id)s",
|
|
"admin_and_matching_user_domain_id": "rule:admin_required and domain_id:%(user.domain_id)s",
|
|
"identity:get_user": "rule:cloud_admin or rule:admin_and_matching_target_user_domain_id",
|
|
"identity:list_users": "rule:cloud_admin or rule:admin_and_matching_domain_id",
|
|
"identity:create_user": "rule:cloud_admin or rule:admin_and_matching_user_domain_id",
|
|
"identity:update_user": "rule:cloud_admin or rule:admin_and_matching_target_user_domain_id",
|
|
"identity:delete_user": "rule:cloud_admin or rule:admin_and_matching_target_user_domain_id",
|
|
|
|
"admin_and_matching_target_group_domain_id": "rule:admin_required and domain_id:%(target.group.domain_id)s",
|
|
"admin_and_matching_group_domain_id": "rule:admin_required and domain_id:%(group.domain_id)s",
|
|
"identity:get_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id",
|
|
"identity:list_groups": "rule:cloud_admin or rule:admin_and_matching_domain_id",
|
|
"identity:list_groups_for_user": "rule:owner or (rule:admin_required and domain_id:%(domain_id)s)",
|
|
"identity:create_group": "rule:cloud_admin or rule:admin_and_matching_group_domain_id",
|
|
"identity:update_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id",
|
|
"identity:delete_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id",
|
|
"identity:list_users_in_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id",
|
|
"identity:remove_user_from_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id",
|
|
"identity:check_user_in_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id",
|
|
"identity:add_user_to_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id",
|
|
|
|
"identity:get_credential": "rule:admin_required",
|
|
"identity:list_credentials": "rule:admin_required",
|
|
"identity:create_credential": "rule:admin_required",
|
|
"identity:update_credential": "rule:admin_required",
|
|
"identity:delete_credential": "rule:admin_required",
|
|
|
|
"identity:ec2_get_credential": "rule:admin_or_cloud_admin or rule:owner",
|
|
"identity:ec2_list_credentials": "rule:admin_or_cloud_admin or rule:owner",
|
|
"identity:ec2_create_credential": "rule:admin_or_cloud_admin or rule:owner",
|
|
"identity:ec2_delete_credential": "(rule:admin_or_cloud_admin or rule:owner) or (rule:owner and user_id:%(target.credential.user_id)s)",
|
|
|
|
"identity:get_role": "rule:admin_or_cloud_admin",
|
|
"identity:list_roles": "rule:admin_or_cloud_admin",
|
|
"identity:create_role": "rule:cloud_admin",
|
|
"identity:update_role": "rule:cloud_admin",
|
|
"identity:delete_role": "rule:cloud_admin",
|
|
|
|
"domain_admin_for_grants": "rule:admin_required and (domain_id:%(domain_id)s or domain_id:%(target.project.domain_id)s)",
|
|
"project_admin_for_grants": "rule:admin_required and project_id:%(project_id)s",
|
|
"identity:check_grant": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
|
|
"identity:list_grants": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
|
|
"identity:create_grant": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
|
|
"identity:revoke_grant": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
|
|
|
|
"admin_on_domain_filter" : "rule:cloud_admin or (rule:admin_required and domain_id:%(scope.domain.id)s)",
|
|
"admin_on_project_filter" : "rule:cloud_admin or (rule:admin_required and project_id:%(scope.project.id)s)",
|
|
"identity:list_role_assignments": "rule:admin_on_domain_filter or rule:admin_on_project_filter",
|
|
|
|
"identity:get_policy": "rule:cloud_admin",
|
|
"identity:list_policies": "rule:cloud_admin",
|
|
"identity:create_policy": "rule:cloud_admin",
|
|
"identity:update_policy": "rule:cloud_admin",
|
|
"identity:delete_policy": "rule:cloud_admin",
|
|
|
|
"identity:change_password": "rule:owner",
|
|
"identity:check_token": "rule:admin_or_owner",
|
|
"identity:validate_token": "rule:service_or_admin",
|
|
"identity:validate_token_head": "rule:service_or_admin",
|
|
"identity:revocation_list": "rule:service_or_admin",
|
|
"identity:revoke_token": "rule:admin_or_owner",
|
|
|
|
"identity:create_trust": "user_id:%(trust.trustor_user_id)s",
|
|
"identity:get_trust": "rule:admin_or_owner",
|
|
"identity:list_trusts": "",
|
|
"identity:list_roles_for_trust": "",
|
|
"identity:check_role_for_trust": "",
|
|
"identity:get_role_for_trust": "",
|
|
"identity:delete_trust": "",
|
|
|
|
"identity:create_consumer": "rule:admin_required",
|
|
"identity:get_consumer": "rule:admin_required",
|
|
"identity:list_consumers": "rule:admin_required",
|
|
"identity:delete_consumer": "rule:admin_required",
|
|
"identity:update_consumer": "rule:admin_required",
|
|
|
|
"identity:authorize_request_token": "rule:admin_required",
|
|
"identity:list_access_token_roles": "rule:admin_required",
|
|
"identity:get_access_token_role": "rule:admin_required",
|
|
"identity:list_access_tokens": "rule:admin_required",
|
|
"identity:get_access_token": "rule:admin_required",
|
|
"identity:delete_access_token": "rule:admin_required",
|
|
|
|
"identity:list_projects_for_endpoint": "rule:admin_required",
|
|
"identity:add_endpoint_to_project": "rule:admin_required",
|
|
"identity:check_endpoint_in_project": "rule:admin_required",
|
|
"identity:list_endpoints_for_project": "rule:admin_required",
|
|
"identity:remove_endpoint_from_project": "rule:admin_required",
|
|
|
|
"identity:create_identity_provider": "rule:admin_required",
|
|
"identity:list_identity_providers": "rule:admin_required",
|
|
"identity:get_identity_providers": "rule:admin_required",
|
|
"identity:update_identity_provider": "rule:admin_required",
|
|
"identity:delete_identity_provider": "rule:admin_required",
|
|
|
|
"identity:create_protocol": "rule:admin_required",
|
|
"identity:update_protocol": "rule:admin_required",
|
|
"identity:get_protocol": "rule:admin_required",
|
|
"identity:list_protocols": "rule:admin_required",
|
|
"identity:delete_protocol": "rule:admin_required",
|
|
|
|
"identity:create_mapping": "rule:admin_required",
|
|
"identity:get_mapping": "rule:admin_required",
|
|
"identity:list_mappings": "rule:admin_required",
|
|
"identity:delete_mapping": "rule:admin_required",
|
|
"identity:update_mapping": "rule:admin_required",
|
|
|
|
"identity:list_projects_for_groups": "",
|
|
"identity:list_domains_for_groups": "",
|
|
|
|
"identity:list_revoke_events": ""
|
|
}
|