residual grants after delete action

[gordon chung]

currently, if you delete a role, the grant still exists (except for user-project grant which gets cleaned up on role delete).

grant should be dropped as well to avoid possible security issues.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/22008

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/22008
Committed: http://github.com/openstack/keystone/commit/e16742bdf2f1fa7386f2983b037a78fde4a576c3
Submitter: Jenkins
Branch: master

commit e16742bdf2f1fa7386f2983b037a78fde4a576c3
Author: Gordon Chung <email address hidden>
Date: Thu Feb 14 19:55:00 2013 -0500

    residual grants after delete action (bug1125637)

    remove all applicable grants when role is deleted
    (sql/kvs solution only)

    Fixes: bug #1125637
    Change-Id: I3a958c6d56739e37a95f6c713fab154827e9ceca

[Kurt Seifried (kseifried)]

Are these grants still accessible in some way? I'm trying to figure out if this is security hardening or a security flaw. It appears to be security hardening, can anyone confirm it?

[Adam Young (ayoung)]

Yes, but the real security issue is on the enforcement side, which is based on policy. Dropping the Role does not drop the policy enforcement, which is usually of the form "user need the role R on Project Pin order to execute the method M that affect project P" so just dropping the role is not sufficient to revoke that role from all users, and will have not effect on the overall system. It is surprising, but not necessarily a security bug. Still worth fixing and probably back porting the fix.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/27978

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/27978
Committed: http://github.com/openstack/keystone/commit/76efb5c736c5a52fc3dee3a114279b10eb590544
Submitter: Jenkins
Branch: stable/grizzly

commit 76efb5c736c5a52fc3dee3a114279b10eb590544
Author: Gordon Chung <email address hidden>
Date: Thu Feb 14 19:55:00 2013 -0500

    residual grants after delete action (bug1125637)

    remove all applicable grants when role is deleted
    (sql/kvs solution only)

    Fixes: bug #1125637

    Change-Id: I3a958c6d56739e37a95f6c713fab154827e9ceca
    (cherry picked from commit e16742bdf2f1fa7386f2983b037a78fde4a576c3)