openstack
/
keystone
Code Issues Proposed changes

Merge "Document scope_types for ec2 policies"

This commit is contained in:
Zuul 2018-01-26 20:51:25 +00:00 committed by Gerrit Code Review
parent 2db1d2562c 93b8b59e00
commit a886dd256e
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
keystone/common/policies/ec2_credential.py
View File

@ -18,6 +18,17 @@ ec2_credential_policies = [
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'ec2_get_credential',
check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER,
# FIXME(lbragstad): System administrator should be able to manage all
# ec2 credentials. Users with a system role assignment should be able
# to manage only ec2 credentials keystone can assert belongs to them.
# This is going to require keystone to have "scope" checks in code to
# ensure this is enforced properly. Until keystone has support for
# those cases in code, we're going to have to comment this out. This
# would be a good candidate for a user-scoped operation. If we provide
# scope_types in these policies without proper scope checks in code we
# could expose credentials to users who are not supposed to access
# them.
# scope_types=['system', 'project'],
description='Show ec2 credential details.',
operations=[{'path': ('/v3/users/{user_id}/credentials/OS-EC2/'
'{credential_id}'),
@ -25,18 +36,26 @@ ec2_credential_policies = [
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'ec2_list_credentials',
check_str=base.RULE_ADMIN_OR_OWNER,
# FIXME(lbragstad): See the above comment as to why scope_types is
# commented out.
# scope_types=['system', 'project'],
description='List ec2 credentials.',
operations=[{'path': '/v3/users/{user_id}/credentials/OS-EC2',
'method': 'GET'}]),
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'ec2_create_credential',
check_str=base.RULE_ADMIN_OR_OWNER,
# FIXME(lbragstad): See the above comment as to why scope_types is
# commented out.
description='Create ec2 credential.',
operations=[{'path': '/v3/users/{user_id}/credentials/OS-EC2',
'method': 'POST'}]),
policy.DocumentedRuleDefault(
name=base.IDENTITY % 'ec2_delete_credential',
check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER,
# FIXME(lbragstad): See the above comment as to why scope_types is
# commented out.
# scope_types=['system', 'project'],
description='Delete ec2 credential.',
operations=[{'path': ('/v3/users/{user_id}/credentials/OS-EC2/'
'{credential_id}'),