openstack
/
keystone
Code Issues Proposed changes

Merge "Remove an assignment from domain and project"

This commit is contained in:
Zuul 2020-08-25 22:54:38 +00:00 committed by Gerrit Code Review
parent f7c0b6bcd5 28faa24e68
commit 63a4d95ea2
3 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
keystone/assignment/backends/sql.py
View File

@ -78,7 +78,14 @@ class Assignment(base.AssignmentDriverBase):
domain_id, project_id, inherited_to_projects):
q = session.query(RoleAssignment)
q = q.filter_by(actor_id=user_id or group_id)
q = q.filter_by(target_id=project_id or domain_id)
if domain_id:
q = q.filter_by(target_id=domain_id).filter(
(RoleAssignment.type == AssignmentType.USER_DOMAIN) |
(RoleAssignment.type == AssignmentType.GROUP_DOMAIN))
else:
q = q.filter_by(target_id=project_id).filter(
(RoleAssignment.type == AssignmentType.USER_PROJECT) |
(RoleAssignment.type == AssignmentType.GROUP_PROJECT))
q = q.filter_by(role_id=role_id)
q = q.filter_by(inherited=inherited_to_projects)
return q

2
keystone/tests/unit/test_v3_assignment.py
View File

@ -24,7 +24,6 @@ from keystone import exception
from keystone.resource.backends import base as resource_base
from keystone.tests import unit
from keystone.tests.unit import test_v3
from keystone.tests.unit import utils as test_utils
CONF = keystone.conf.CONF
@ -1995,7 +1994,6 @@ class AssignmentInheritanceTestCase(test_v3.RestfulTestCase,
self._test_list_role_assignments_include_names(role)
@test_utils.wip("Skipped until Bug 1754677 is resolved")
def test_remove_assignment_for_project_acting_as_domain(self):
"""Test goal: remove assignment for project acting as domain.

8
releasenotes/notes/bug-1754677-13ee75ed1b473f26.yaml Normal file
View File

@ -0,0 +1,8 @@
---
fixes:
- >
[`bug 1754677 <https://bugs.launchpad.net/keystone/+bug/1754677>`_]
When you setup a user with a role assignment on a domain and then a role
assignment on a project "acting as a domain", you can't actually remove them.
This fixes it by filtering the query by "type" i.e either a USER_DOMAIN or
a USER_PROJECT in role assignment table.