c3c6d9854c
When user requests new application credentials without specifying roles explicitly all current roles from the token are being used for that (including implied roles). When new application credentials are requested specifying a role that implies another role (i.e. member) only that role is added into the list. This is not what is expected, so change it by looping through every requested role and add every implied role into the list if it is not already there. Related-Bug: https://bugs.launchpad.net/keystone/+bug/2030061 Change-Id: I452313ac7e1e6960748bcd1e667fb7c0076eb7a2
OpenStack Keystone
OpenStack Keystone provides authentication, authorization and service discovery mechanisms via HTTP primarily for use by projects in the OpenStack family. It is most commonly deployed as an HTTP interface to existing identity systems, such as LDAP.
Developer documentation, the source of which is in
doc/source/, is published at:
The API reference and documentation are available at:
The canonical client library is available at:
Documentation for cloud administrators is available at:
The source of documentation for cloud administrators is available at:
Information about our team meeting is available at:
Release notes is available at:
Bugs and feature requests are tracked on Launchpad at:
Future design work is tracked at:
Contributors are encouraged to join IRC
(#openstack-keystone on OFTC):
Source for the project:
For information on contributing to Keystone, see
CONTRIBUTING.rst.