Do we really need to RBAC protect version resource

[Arvind Tiwari]

Barbican does RBAC check for version call, which does not seems correct behavior.

We should should remove the RBAC check for the version call.

[Chad Lung (chad-lung)]

I don't think we need the version call protected. I think though if we are to remove the protection on the endpoint then we should adopt the OpenStack way of handling API versions, http://docs.openstack.org/api/openstack-compute/2/content/Versions-d1e1193.html#d6e808

Thoughts?

[Arvind Tiwari (arvind-tiwari)]

Yes, I am with you on the version but with this bug we are going to fix the RBAC issue only.

Thoughts?

[Chad Lung (chad-lung)]

This will require changes to the Barbican DevStack (sanity check) script as well. So this fix will have to be synced with that.

[John Wood (john-wood-w)]

Arvind, do you have a fix in mind? I'm curious how to disable authentication processing for select resource/URI-paths, such as '/', or '/v1'.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/79420

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/79420
Committed: https://git.openstack.org/cgit/stackforge/barbican/commit/?id=617addcbc70a36973eddce6b6bfad88e1df2ec8b
Submitter: Jenkins
Branch: master

commit 617addcbc70a36973eddce6b6bfad88e1df2ec8b
Author: Arvind Tiwari <email address hidden>
Date: Mon Mar 10 13:26:45 2014 -0600

    Barbican should not do rbac on version api call

    Closes-Bug: #1290445

    Change-Id: Idcd52600542b017f54c25a75ec0ab37348eb109d