openstack/keystone
Code Issues Proposed changes

Merge "Add scope_types to domain config policies"

Browse Source
This commit is contained in:
Zuul 2018-01-27 00:35:55 +00:00 committed by Gerrit Code Review
commit 249316ddfb
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
keystone/common/policies/domain_config.py
View File

@ -19,6 +19,15 @@ domain_config_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'create_domain_config', name=base.IDENTITY % 'create_domain_config',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
# FIXME(lbragstad): The domain configuration API has traditionally
# required system or cloud administrators. If, or when, keystone
# implements the ability for project administrator to use these APIs,
# then 'project' should be added to scope_types. Adding support for
# project or domain administrator to manage their own domain
# configuration would be useful and alleviate work for system
# administrators, but until we have checks in code that enforce those
# checks, let's keep this as a system-level operation.
scope_types=['system'],
description='Create domain configuration.', description='Create domain configuration.',
operations=[ operations=[
{ {
@ -30,6 +39,7 @@ domain_config_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'get_domain_config', name=base.IDENTITY % 'get_domain_config',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
scope_types=['system'],
description=('Get the entire domain configuration for a domain, an ' description=('Get the entire domain configuration for a domain, an '
'option group within a domain, or a specific ' 'option group within a domain, or a specific '
'configuration option within a group for a domain.'), 'configuration option within a group for a domain.'),
@ -63,6 +73,9 @@ domain_config_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'get_security_compliance_domain_config', name=base.IDENTITY % 'get_security_compliance_domain_config',
check_str='', check_str='',
# This should be accessible to anyone with a valid token, regardless of
# system-scope or project-scope.
scope_types=['system', 'project'],
description=('Get security compliance domain configuration for ' description=('Get security compliance domain configuration for '
'either a domain or a specific option in a domain.'), 'either a domain or a specific option in a domain.'),
operations=[ operations=[
@ -89,6 +102,7 @@ domain_config_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'update_domain_config', name=base.IDENTITY % 'update_domain_config',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
scope_types=['system'],
description=('Update domain configuration for either a domain, ' description=('Update domain configuration for either a domain, '
'specific group or a specific option in a group.'), 'specific group or a specific option in a group.'),
operations=[ operations=[
@ -109,6 +123,7 @@ domain_config_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'delete_domain_config', name=base.IDENTITY % 'delete_domain_config',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
scope_types=['system'],
description=('Delete domain configuration for either a domain, ' description=('Delete domain configuration for either a domain, '
'specific group or a specific option in a group.'), 'specific group or a specific option in a group.'),
operations=[ operations=[
@ -129,6 +144,7 @@ domain_config_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'get_domain_config_default', name=base.IDENTITY % 'get_domain_config_default',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
scope_types=['system'],
description=('Get domain configuration default for either a domain, ' description=('Get domain configuration default for either a domain, '
'specific group or a specific option in a group.'), 'specific group or a specific option in a group.'),
operations=[ operations=[