openstack/heat
Code Issues Proposed changes

Correct deleting of role assignments

Browse Source 
If role assignment is already removed by any means
we do not want to send request to delete it in Heat.

Depends-On: I1fbb1449723843d88501b8f11913e9908fe4cd00
Closes-Bug: #1615947
Change-Id: I15f542c0d5756356a5d5ac14a35704c07903e24b
This commit is contained in:
Dmitriy Uvarenkov 2016-10-01 12:30:30 +03:00
parent 8de00cdc47
commit 58a88d9d4c
2 changed files with 87 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
heat/engine/resources/openstack/keystone/role_assignments.py
View File

@ -123,35 +123,39 @@ class KeystoneRoleAssignmentMixin(object):
user=user_id user=user_id
) )
def _remove_role_assignments_from_group(self, group_id, role_assignments): def _remove_role_assignments_from_group(self, group_id, role_assignments,
current_assignments):
for role_assignment in self._normalize_to_id(role_assignments): for role_assignment in self._normalize_to_id(role_assignments):
if role_assignment.get(self.PROJECT) is not None: if role_assignment in current_assignments:
self.client().roles.revoke( if role_assignment.get(self.PROJECT) is not None:
role=role_assignment.get(self.ROLE), self.client().roles.revoke(
project=role_assignment.get(self.PROJECT), role=role_assignment.get(self.ROLE),
group=group_id project=role_assignment.get(self.PROJECT),
) group=group_id
elif role_assignment.get(self.DOMAIN) is not None: )
self.client().roles.revoke( elif role_assignment.get(self.DOMAIN) is not None:
role=role_assignment.get(self.ROLE), self.client().roles.revoke(
domain=role_assignment.get(self.DOMAIN), role=role_assignment.get(self.ROLE),
group=group_id domain=role_assignment.get(self.DOMAIN),
) group=group_id
)
def _remove_role_assignments_from_user(self, user_id, role_assignments): def _remove_role_assignments_from_user(self, user_id, role_assignments,
current_assignments):
for role_assignment in self._normalize_to_id(role_assignments): for role_assignment in self._normalize_to_id(role_assignments):
if role_assignment.get(self.PROJECT) is not None: if role_assignment in current_assignments:
self.client().roles.revoke( if role_assignment.get(self.PROJECT) is not None:
role=role_assignment.get(self.ROLE), self.client().roles.revoke(
project=role_assignment.get(self.PROJECT), role=role_assignment.get(self.ROLE),
user=user_id project=role_assignment.get(self.PROJECT),
) user=user_id
elif role_assignment.get(self.DOMAIN) is not None: )
self.client().roles.revoke( elif role_assignment.get(self.DOMAIN) is not None:
role=role_assignment.get(self.ROLE), self.client().roles.revoke(
domain=role_assignment.get(self.DOMAIN), role=role_assignment.get(self.ROLE),
user=user_id domain=role_assignment.get(self.DOMAIN),
) user=user_id
)
def _normalize_to_id(self, role_assignment_prps): def _normalize_to_id(self, role_assignment_prps):
role_assignments = [] role_assignments = []
@ -272,26 +276,34 @@ class KeystoneRoleAssignmentMixin(object):
new_role_assignments) new_role_assignments)
if len(removed_role_assignments) > 0: if len(removed_role_assignments) > 0:
current_assignments = self.parse_list_assignments(
user_id=user_id, group_id=group_id)
if user_id is not None: if user_id is not None:
self._remove_role_assignments_from_user( self._remove_role_assignments_from_user(
user_id, user_id,
removed_role_assignments) removed_role_assignments,
current_assignments)
elif group_id is not None: elif group_id is not None:
self._remove_role_assignments_from_group( self._remove_role_assignments_from_group(
group_id, group_id,
removed_role_assignments) removed_role_assignments,
current_assignments)
def delete_assignment(self, user_id=None, group_id=None): def delete_assignment(self, user_id=None, group_id=None):
self._stored_properties_data self._stored_properties_data
if self.properties[self.ROLES] is not None: if self.properties[self.ROLES] is not None:
current_assignments = self.parse_list_assignments(
user_id=user_id, group_id=group_id)
if user_id is not None: if user_id is not None:
self._remove_role_assignments_from_user( self._remove_role_assignments_from_user(
user_id, user_id,
(self.properties[self.ROLES])) (self.properties[self.ROLES]),
current_assignments)
elif group_id is not None: elif group_id is not None:
self._remove_role_assignments_from_group( self._remove_role_assignments_from_group(
group_id, group_id,
(self.properties[self.ROLES])) (self.properties[self.ROLES]),
current_assignments)
def validate_assignment_properties(self): def validate_assignment_properties(self):
if self.properties.get(self.ROLES) is not None: if self.properties.get(self.ROLES) is not None:

45
heat/tests/openstack/keystone/test_role_assignments.py
View File

@ -96,6 +96,16 @@ class KeystoneRoleAssignmentMixinTest(common.HeatTestCase):
(self.test_role_assignment.client_plugin. (self.test_role_assignment.client_plugin.
return_value) = self.keystone_client_plugin return_value) = self.keystone_client_plugin
self.parse_assgmnts = self.test_role_assignment.parse_list_assignments
self.test_role_assignment.parse_list_assignments = mock.MagicMock()
self.test_role_assignment.parse_list_assignments.return_value = [
{'role': 'role_1',
'domain': 'domain_1',
'project': None},
{'role': 'role_1',
'project': 'project_1',
'domain': None}]
def test_properties_title(self): def test_properties_title(self):
property_title_map = {MixinClass.ROLES: 'roles'} property_title_map = {MixinClass.ROLES: 'roles'}
@ -325,6 +335,21 @@ class KeystoneRoleAssignmentMixinTest(common.HeatTestCase):
group='group_1', group='group_1',
project='project_1') project='project_1')
def test_role_assignment_delete_removed(self):
self.test_role_assignment.parse_list_assignments.return_value = [
{'role': 'role_1',
'domain': 'domain_1',
'project': None}]
self.assertIsNone(self.test_role_assignment.delete_assignment(
user_id='user_1'))
expected = [
({'role': 'role_1', 'user': 'user_1', 'domain': 'domain_1'},)
]
self.assertItemsEqual(expected, self.roles.revoke.call_args_list)
def test_validate_1(self): def test_validate_1(self):
self.test_role_assignment.properties = mock.MagicMock() self.test_role_assignment.properties = mock.MagicMock()
@ -347,6 +372,7 @@ class KeystoneRoleAssignmentMixinTest(common.HeatTestCase):
self.test_role_assignment.validate) self.test_role_assignment.validate)
def test_empty_parse_list_assignments(self): def test_empty_parse_list_assignments(self):
self.test_role_assignment.parse_list_assignments = self.parse_assgmnts
self.assertEqual([], self.assertEqual([],
self.test_role_assignment.parse_list_assignments()) self.test_role_assignment.parse_list_assignments())
@ -357,6 +383,7 @@ class KeystoneRoleAssignmentMixinTest(common.HeatTestCase):
self._test_parse_list_assignments('group') self._test_parse_list_assignments('group')
def _test_parse_list_assignments(self, entity=None): def _test_parse_list_assignments(self, entity=None):
self.test_role_assignment.parse_list_assignments = self.parse_assgmnts
dict_obj = mock.MagicMock() dict_obj = mock.MagicMock()
dict_obj.to_dict.side_effect = [{'scope': { dict_obj.to_dict.side_effect = [{'scope': {
'project': {'id': 'fc0fe982401643368ff2eb11d9ca70f1'}}, 'project': {'id': 'fc0fe982401643368ff2eb11d9ca70f1'}},
@ -419,6 +446,15 @@ class KeystoneUserRoleAssignmentTest(common.HeatTestCase):
(self.test_role_assignment.client_plugin. (self.test_role_assignment.client_plugin.
return_value) = self.keystone_client_plugin return_value) = self.keystone_client_plugin
self.test_role_assignment.parse_list_assignments = mock.MagicMock()
self.test_role_assignment.parse_list_assignments.return_value = [
{'role': 'role_1',
'domain': 'domain_1',
'project': None},
{'role': 'role_1',
'project': 'project_1',
'domain': None}]
def test_user_role_assignment_handle_create(self): def test_user_role_assignment_handle_create(self):
self.test_role_assignment.handle_create() self.test_role_assignment.handle_create()
@ -539,6 +575,15 @@ class KeystoneGroupRoleAssignmentTest(common.HeatTestCase):
(self.test_role_assignment.client_plugin. (self.test_role_assignment.client_plugin.
return_value) = self.keystone_client_plugin return_value) = self.keystone_client_plugin
self.test_role_assignment.parse_list_assignments = mock.MagicMock()
self.test_role_assignment.parse_list_assignments.return_value = [
{'role': 'role_1',
'domain': 'domain_1',
'project': None},
{'role': 'role_1',
'project': 'project_1',
'domain': None}]
def test_group_role_assignment_handle_create(self): def test_group_role_assignment_handle_create(self):
self.test_role_assignment.handle_create() self.test_role_assignment.handle_create()