keystone/releasenotes/notes/bug-1804522-00df902cd2d74ee3.yaml
Lance Bragstad 7ce5e3e24e Update service provider policies for system admin
This change makes the policy definitions for admin service
provider operations consistent with the other service provider
policies. Subsequent patches will incorporate:

 - domain users test coverage
 - project users test coverage

Change-Id: I621192f089d1b29e2585d0030716348274e50bf1
Related-Bug: 1804520
Closes-Bug: 1804522
2019-01-04 17:58:31 +00:00

35 lines
1.6 KiB
YAML

---
features:
- |
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
The federated service provider API now supports the ``admin``, ``member``,
and ``reader`` default roles.
upgrade:
- |
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
The federated service provider API uses new default policies that
make it more accessible to end users and administrators. Please consider
these new defaults if your deployment overrides federated service provider
policies.
deprecations:
- |
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
The federated service provider policies have been deprecated. The
``identity:get_service_provider`` and
``identity:list_service_providers`` policies now use ``role:reader
and system_scope:all`` instead of ``rule:admin_required``. The
``identity:create_service_provider``,
``identity:update_service_provider``, and
``identity:delete_service_provider`` policies now use ``role:admin
and system_scope:all`` instead of ``rule:admin_required``. These
new defaults automatically include support for a read-only role
and allow for more granular access to service provider APIs,
making it easier for system administrators to delegate
authorization. Please consider these new defaults if your
deployment overrides the federated service provider policies.
security:
- |
[`bug 1804522 <https://bugs.launchpad.net/keystone/+bug/1804522>`_]
The federated service provider API now uses system-scope and default
roles to provide better accessibility to users in a secure way.