Colleen Murphy 09e699baba Move get_role_for_trust enforcement to policies ... Without this change, policy enforcement for the GET /OS-TRUST/trusts/{trust_id}/roles/{role_id} API is hardcoded in the flask dispatcher code. This is a problem because this enforcement can't be controlled by the operator, as is the norm. Moreover, it makes the transition to system-scope and default-roles-aware policies more difficult because there's no sensible migration from "" to a logical role-based check string. This converts the hardcoded enforcement to enforcement via default policies for GET /OS-TRUST/trusts/{trust_id}/roles/{role_id}. The API specifically blocks the is_admin user from using it, and since policies aren't loaded for the is_admin user we need to continue explicitly blocking it. This change does not use the formal oslo.policy deprecation system because "" OR'd with the new default is entirely useless as a policy. Change-Id: Ib5a6a87313aa7b2a73211f512b8a8c675a21b52f Partial-bug: #1818850 Partial-bug: #1818846		2019-08-16 15:20:15 -07:00
..
doctor	Remove uuid token size check from doctor	2018-07-13 08:34:57 +08:00
__init__.py	Entrypoints for commands	2015-03-27 02:16:02 +00:00
bootstrap.py	Support endpoint updates in bootstrap	2019-04-15 12:25:51 -07:00
cli.py	Don't throw valueerror on bootstrap	2019-05-23 14:37:11 +00:00
manage.py	Allow for more robust config checking with keystone-manage	2018-08-07 14:24:12 +00:00
status.py	Move get_role_for_trust enforcement to policies	2019-08-16 15:20:15 -07:00