Delegated tokens (application_credential, OAuth1, trust, and
ec2credential) could read, create, modify, or delete credentials
via /v3/credentials and the OS-EC2 compat endpoint. The existing
guards only compared project_id and never treated ec2credential
as delegated.
Replace those guards with a primary-auth-only gate: any token
whose methods aren't entirely primary auth methods, or that
carries a trust_id, is rejected from GET/POST/PATCH/DELETE on
those endpoints. This also removes trust/OAuth1 EC2 credential
creation, never a deliberate feature (bug 1242597 /
OSSA-2013-032).
PATCH now only accepts `blob`; `type`, `user_id`, and
`project_id` are immutable after creation. Delete and recreate
the credential to change them. This also closes bug 2158931: the
old guard only validated the stored (pre-image) project_id on
PATCH, never the new project_id in the request body, so a
delegated token scoped to project A could rewrite project_id to
any project B on a credential it already owned in A. Banning
project_id from PATCH entirely removes that write path for every
caller, not just delegated tokens.
Narrow the existing, deprecated
allow_insecure_admin_trust_cross_project_credentials_access
option (LP#2150089) to ec2-type credentials only, matching its
documented use case: an admin-role trust used to list/sync EC2
credentials.
An empty token.methods list is treated as delegated.
Uses keystone.api._shared.delegation from the LP#2153453 change.
Closes-Bug: #2159643
Closes-Bug: #2158931
Depends-On: https://review.opendev.org/c/openstack/tempest/+/1002295
Depends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296
Change-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33
Assisted-by: Cursor Grok 4.6 <noreply@cursor.com>
Signed-off-by: Grzegorz Grasza <xek@redhat.com>
Grzegorz Grasza
42d80b5d28