Colleen Murphy 17c337dbdb Fix credential list for project members ... Without this patch, project members and readers can list any credentials with the /v3/credentials API when enforce_scope is false. enforce_scope is only applicable to project admins due to the admin-ness problem[1], and this policy is not meant to allow project admins any access to users' credentials (only system admins should be able to access them). However, when enforce_scope is false, we need to preserve the old behavior of project admins being able to list all credentials. This change mitigates the problem by running the identity:get_credential policy check to filter out credentials the user does not have access to. This will impact performance. Closes-bug: #1855080 [1] https://bugs.launchpad.net/keystone/+bug/968696 Change-Id: I5dd85a6b8368373a27aef2942a64499d020662ef		2019-12-04 16:42:17 -08:00
..
notes	Fix credential list for project members	2019-12-04 16:42:17 -08:00
source	Merge "Update master for stable/train"	2019-10-14 20:56:19 +00:00