openstack/keystone
Code Issues Proposed changes

Add scope_types to grant policies

Browse Source 
Since grants can exist on either the system or a project, it makes
sense to have them associated to both `system` and `project` scopes.
But until we have logic in keystone that can enforce those checks, we
keep the scope_types set to `system`. This ensures backwards
compatibility and helps resolve admin-ness issues until we get to
that point.

Change-Id: I310c88bae7986e3163408f621e266f96fd255edc
This commit is contained in:
Lance Bragstad 2017-12-06 17:31:44 +00:00
parent 90d739b52b
commit 7dbf84c024
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
keystone/common/policies/grant.py
View File

@ -59,6 +59,13 @@ grant_policies = [
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'check_grant',
check_str=base.RULE_ADMIN_REQUIRED,
# FIXME(lbragstad): A system administrator should be able to grant role
# assignments from any actor to any target in the deployment. Domain
# administrators should only be able to grant access to the domain they
# administer or projects within that domain. Once keystone is smart
# enough to enforce those checks in code, we can add 'project' to the
# list of scope_types below.
scope_types=['system'],
description=('Check a role grant between a target and an actor. A '
'target can be either a domain or a project. An actor '
'can be either a user or a group. These terms also apply '
@ -69,6 +76,9 @@ grant_policies = [
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'list_grants',
check_str=base.RULE_ADMIN_REQUIRED,
# FIXME(lbragstad): See the above comment about scope_types before
# adding 'project' to scope_types below.
scope_types=['system'],
description=('List roles granted to an actor on a target. A target '
'can be either a domain or a project. An actor can be '
'either a user or a group. For the OS-INHERIT APIs, it '
@ -79,6 +89,9 @@ grant_policies = [
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'create_grant',
check_str=base.RULE_ADMIN_REQUIRED,
# FIXME(lbragstad): See the above comment about scope_types before
# adding 'project' to scope_types below.
scope_types=['system'],
description=('Create a role grant between a target and an actor. A '
'target can be either a domain or a project. An actor '
'can be either a user or a group. These terms also apply '
@ -89,6 +102,9 @@ grant_policies = [
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'revoke_grant',
check_str=base.RULE_ADMIN_REQUIRED,
# FIXME(lbragstad): See the above comment about scope_types before
# adding 'project' to scope_types below.
scope_types=['system'],
description=('Revoke a role grant between a target and an actor. A '
'target can be either a domain or a project. An actor '
'can be either a user or a group. These terms also apply '