openstack/devstack
Code Issues Proposed changes

Always add the service role to service users

Browse Source 
When creating a service user we allow the user to be created with a
different role. Currently in auth_token middleware we want to check that
the service token is specified with the service role so we should always
add the service role and optionally add additional roles.

Change-Id: Ie954a679674b4795079b539ebc8d4d2dcbd7dacc
This commit is contained in:
Jamie Lennox 2016-12-13 15:47:11 +11:00
parent c95ca63ae3
commit 7f68548538
1 changed files with 6 additions and 4 deletions

10
lib/keystone

@ -445,14 +445,16 @@ function create_keystone_accounts {
#
# create_service_user <name> [role]
#
# The role defaults to the service role. It is allowed to be provided as optional as historically
# We always add the service role, other roles are also allowed to be added as historically
# a lot of projects have configured themselves with the admin or other role here if they are
# using this user for other purposes beyond simply auth_token middleware.
function create_service_user {
local role=${2:-service}
get_or_create_user "$1" "$SERVICE_PASSWORD" "$SERVICE_DOMAIN_NAME"
get_or_add_user_project_role "$role" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
get_or_add_user_project_role service "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
if [[ -n "$2" ]]; then
get_or_add_user_project_role "$2" "$1" "$SERVICE_PROJECT_NAME" "$SERVICE_DOMAIN_NAME" "$SERVICE_DOMAIN_NAME"
fi
}
# Configure the service to use the auth token middleware.