d2cc4c83c0
This commit removes user policies from policy.v3cloudsample.json. By incorporating system-scope, domain-scope, project-scope, and default roles, we've effectively made these policies obsolete. We can simplify what we maintain and provide a more consistent, unified view of default user behavior by removing them. This commit also adds an important filter to the GET /v3/users API by making sure the users in the response are filtered properly if the API was called with a domain-scoped token. This is needed in case domain configuration isn't setup and short-circuits normalization of the domain ID, which sometimes comes from the token if it is domain-scoped. Regardless of domain configuration being used, we should protect against cases where data leaks across domains in the name of security. Finally, this commit moves a couple of tests from test_v3_protection to test_users protection tests that ensures we do reasonable filtering while normalizing domain IDs. The remaining tests from test_v3_protection have been removed because they are no longer applicable. These tests were testing an HTTP 403 was returned when a domain users attempted to filter users for domains they didn't have authorization on. We don't use this approach consistently in keystone. Most other places where filtering is implemented, we ignore invalid filters and instead return an empty list. For domain users attempting to fish information out of another domain, they will receive an empty list to be consistent with other parts of the API. Change-Id: I60b2e2b8af172c369eab0eb2c29f056f5c98ad16 Parial-Bug: 1806762
16 lines
639 B
YAML
16 lines
639 B
YAML
---
|
|
upgrade:
|
|
- |
|
|
[`bug 1806762 <https://bugs.launchpad.net/keystone/+bug/1806762>`_]
|
|
The user policies defined in ``policy.v3cloudsample.json`` have
|
|
been removed. These policies are now obsolete after incorporating
|
|
system-scope, domain-scope, and project-scope into the user API
|
|
and implementing default roles.
|
|
fixes:
|
|
- |
|
|
[`bug 1806762 <https://bugs.launchpad.net/keystone/+bug/1806762>`_]
|
|
The user policies in ``policy.v3cloudsample.json`` policy file
|
|
have been removed in favor of better defaults in code. These
|
|
policies weren't tested exhaustively and were misleading to users
|
|
and operators.
|