openstack
/
keystone
Code Issues Proposed changes
keystone/keystone/tests/protection/v3
History
Colleen Murphy 17c337dbdb Fix credential list for project members 
Without this patch, project members and readers can list any credentials
with the /v3/credentials API when enforce_scope is false. enforce_scope
is only applicable to project admins due to the admin-ness problem[1],
and this policy is not meant to allow project admins any access to users'
credentials (only system admins should be able to access them). However,
when enforce_scope is false, we need to preserve the old behavior of
project admins being able to list all credentials. This change mitigates
the problem by running the identity:get_credential policy check to
filter out credentials the user does not have access to. This will
impact performance.

Closes-bug: #1855080

[1] https://bugs.launchpad.net/keystone/+bug/968696

Change-Id: I5dd85a6b8368373a27aef2942a64499d020662ef
 		2019-12-04 16:42:17 -08:00
..
__init__.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_access_rules.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_application_credential.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_assignment.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_consumer.py Move remaining protection tests 2019-09-18 08:40:39 -07:00
test_credentials.py Fix credential list for project members 2019-12-04 16:42:17 -08:00
test_domain_config.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_domain_roles.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_domains.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_ec2_credential.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_endpoint_group.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_endpoints.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_grants.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_groups.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_identity_providers.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_implied_roles.py Move remaining protection tests 2019-09-18 08:40:39 -07:00
test_limits.py Add tests for project users interacting with limits 2019-09-24 19:22:58 -07:00
test_mappings.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_policy.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_policy_association.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_project_endpoint.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_project_tags.py Add default roles and scope checking to project tags 2019-09-19 02:48:39 +00:00
test_projects.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_protocols.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_regions.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_registered_limits.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_roles.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_service_providers.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_services.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00
test_system_assignments.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_tokens.py Remove legacy protection tests 2019-10-07 12:21:02 +00:00
test_trusts.py Re-enable line-length linter 2019-10-21 08:48:47 -07:00
test_users.py Split protection unit tests into its own job 2019-09-16 10:56:42 -07:00