From 8658011e41c05f79694eb4df306e07a0db1ce9a9 Mon Sep 17 00:00:00 2001 From: Lance Bragstad Date: Thu, 29 Nov 2018 18:27:04 +0000 Subject: [PATCH] Add registered limit tests for system member role From keystone-perspective, the ``member`` and ``reader`` roles are effectively the same, isolating writeable registered limit operations to the ``admin`` role. This commit adds explicit testing to make sure the ``member`` role is allowed to perform readable and not writable registered limits operations. Subsequent patches will incorporate: - system admin functionality - testing for domain users - testing for project users Change-Id: I6c428422f09e788faf2179d24cc01eb1ab623b64 Related-Bug: 1805372 Related-Bug: 1805880 --- .../protection/v3/test_registered_limits.py | 34 ++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/keystone/tests/unit/protection/v3/test_registered_limits.py b/keystone/tests/unit/protection/v3/test_registered_limits.py index e1ac24b4e8..42a4713850 100644 --- a/keystone/tests/unit/protection/v3/test_registered_limits.py +++ b/keystone/tests/unit/protection/v3/test_registered_limits.py @@ -133,7 +133,6 @@ class _UserRegisteredLimitTests(object): class SystemReaderTests(base_classes.TestCaseWithBootstrap, common_auth.AuthTestMixin, _UserRegisteredLimitTests): - def setUp(self): super(SystemReaderTests, self).setUp() self.loadapp() @@ -161,3 +160,36 @@ class SystemReaderTests(base_classes.TestCaseWithBootstrap, r = c.post('/v3/auth/tokens', json=auth) self.token_id = r.headers['X-Subject-Token'] self.headers = {'X-Auth-Token': self.token_id} + + +class SystemMemberTests(base_classes.TestCaseWithBootstrap, + common_auth.AuthTestMixin, + _UserRegisteredLimitTests): + + def setUp(self): + super(SystemMemberTests, self).setUp() + self.loadapp() + self.useFixture(ksfixtures.Policy(self.config_fixture)) + self.config_fixture.config(group='oslo_policy', enforce_scope=True) + + system_member = unit.new_user_ref( + domain_id=CONF.identity.default_domain_id + ) + self.user_id = PROVIDERS.identity_api.create_user( + system_member + )['id'] + PROVIDERS.assignment_api.create_system_grant_for_user( + self.user_id, self.bootstrapper.member_role_id + ) + + auth = self.build_authentication_request( + user_id=self.user_id, password=system_member['password'], + system=True + ) + + # Grab a token using the persona we're testing and prepare headers + # for requests we'll be making in the tests. + with self.test_client() as c: + r = c.post('/v3/auth/tokens', json=auth) + self.token_id = r.headers['X-Subject-Token'] + self.headers = {'X-Auth-Token': self.token_id}