7ce5e3e24e
This change makes the policy definitions for admin service provider operations consistent with the other service provider policies. Subsequent patches will incorporate: - domain users test coverage - project users test coverage Change-Id: I621192f089d1b29e2585d0030716348274e50bf1 Related-Bug: 1804520 Closes-Bug: 1804522
35 lines
1.6 KiB
YAML
35 lines
1.6 KiB
YAML
---
|
|
features:
|
|
- |
|
|
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
|
|
The federated service provider API now supports the ``admin``, ``member``,
|
|
and ``reader`` default roles.
|
|
upgrade:
|
|
- |
|
|
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
|
|
The federated service provider API uses new default policies that
|
|
make it more accessible to end users and administrators. Please consider
|
|
these new defaults if your deployment overrides federated service provider
|
|
policies.
|
|
deprecations:
|
|
- |
|
|
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
|
|
The federated service provider policies have been deprecated. The
|
|
``identity:get_service_provider`` and
|
|
``identity:list_service_providers`` policies now use ``role:reader
|
|
and system_scope:all`` instead of ``rule:admin_required``. The
|
|
``identity:create_service_provider``,
|
|
``identity:update_service_provider``, and
|
|
``identity:delete_service_provider`` policies now use ``role:admin
|
|
and system_scope:all`` instead of ``rule:admin_required``. These
|
|
new defaults automatically include support for a read-only role
|
|
and allow for more granular access to service provider APIs,
|
|
making it easier for system administrators to delegate
|
|
authorization. Please consider these new defaults if your
|
|
deployment overrides the federated service provider policies.
|
|
security:
|
|
- |
|
|
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
|
|
The federated service provider API now uses system-scope and default
|
|
roles to provide better accessibility to users in a secure way.
|