Remove protocol policies from v3cloudsample.json

By incorporating system-scope and default roles, we've effectively
made these policies obsolete. We can simplify what we maintain and
provide a more consistent, unified view of default protocol
behavior by removing them.

Related-Bug: 1806762
Closes-Bug: 1804518
Change-Id: Ia839555d8211596213311c4246135cdae4f46ab2
This commit is contained in:
Lance Bragstad 2018-12-14 21:54:42 +00:00
parent 169bf3e677
commit 24b8db9e06
3 changed files with 22 additions and 6 deletions

View File

@ -171,12 +171,6 @@
"identity:add_endpoint_group_to_project": "rule:admin_required",
"identity:remove_endpoint_group_from_project": "rule:admin_required",
"identity:create_protocol": "rule:cloud_admin",
"identity:update_protocol": "rule:cloud_admin",
"identity:get_protocol": "rule:cloud_admin",
"identity:list_protocols": "rule:cloud_admin",
"identity:delete_protocol": "rule:cloud_admin",
"identity:get_auth_catalog": "",
"identity:get_auth_projects": "",
"identity:get_auth_domains": "",

View File

@ -216,6 +216,11 @@ class PolicyJsonTestCase(unit.TestCase):
'identity:list_identity_providers',
'identity:update_identity_provider',
'identity:delete_identity_provider',
'identity:create_protocol',
'identity:get_protocol',
'identity:list_protocols',
'identity:update_protocol',
'identity:delete_protocol',
'identity:create_domain',
'identity:get_domain',
'identity:list_domains',

View File

@ -0,0 +1,17 @@
---
upgrade:
- |
[`bug 1806762 <https://bugs.launchpad.net/keystone/+bug/1806762>`_]
[`bug 1804518 <https://bugs.launchpad.net/keystone/+bug/1804518>`_]
The protocol policies defined in the ``policy.v3cloudsample.json``
policy file have been removed. These policies are now obsolete after
incorporating system-scope into the federated protocol API and
implementing default roles.
fixes:
- |
[`bug 1806762 <https://bugs.launchpad.net/keystone/+bug/1806762>`_]
[`bug 1804518 <https://bugs.launchpad.net/keystone/+bug/1804518>`_]
The federated protocol policies in the ``policy.v3cloudsample.json``
policy file have been removed in favor of better defaults in code.
These policies weren't tested exhaustively and were misleading to
users and operators.