openstack
/
keystone
Code Issues Proposed changes

Document scope_types for credential policies 

This change adds scope types for all credential policies and sets it
to `system` and `project`, but leaves them commented out. When
keystone supports the ability to enforce credential checks in code
based on the system-scoped tokens versus project-scoped tokens, we
can uncomment the scope_types and allow them to be enforced.

This commit describes how those API should behave in different
circumstances and gives us something track using bugs.

Change-Id: I61b15f3b2865e516a5358b9caacdb7ca8f6f1d17
This commit is contained in:
Lance Bragstad 2017-12-06 20:56:37 +00:00
parent c59c660a10
commit 757a8b04a5
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
keystone/common/policies/credential.py
View File

@ -18,30 +18,45 @@ credential_policies = [
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'get_credential',
check_str=base.RULE_ADMIN_REQUIRED,
# FIXME(lbragstad): Credentials aren't really project-scoped or
# system-scoped. Instead, they are tied to a user. If this API is
# called with a system-scoped token, it's a system-administrator and
# they should be able to get any credential for management reasons. If
# this API is called with a project-scoped token, then extra
# enforcement needs to happen based on who created the credential, what
# projects they are members of, and the project the token is scoped to.
# When we fully support the second case, we can add `project` to the
# list of scope_types. This comment applies to the rest of the policies
# in this module.
# scope_types=['system', 'project'],
description='Show credentials details.',
operations=[{'path': '/v3/credentials/{credential_id}',
'method': 'GET'}]),
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'list_credentials',
check_str=base.RULE_ADMIN_REQUIRED,
# scope_types=['system', 'project'],
description='List credentials.',
operations=[{'path': '/v3/credentials',
'method': 'GET'}]),
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'create_credential',
check_str=base.RULE_ADMIN_REQUIRED,
# scope_types=['system', 'project'],
description='Create credential.',
operations=[{'path': '/v3/credentials',
'method': 'POST'}]),
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'update_credential',
check_str=base.RULE_ADMIN_REQUIRED,
# scope_types=['system', 'project'],
description='Update credential.',
operations=[{'path': '/v3/credentials/{credential_id}',
'method': 'PATCH'}]),
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'delete_credential',
check_str=base.RULE_ADMIN_REQUIRED,
# scope_types=['system', 'project'],
description='Delete credential.',
operations=[{'path': '/v3/credentials/{credential_id}',
'method': 'DELETE'}])