Disabling a domain does not disable the projects in that domain

[Guang Yee]

User from an enabled domain can still get a token scoped to a project in a disabled domain.

Steps to reproduce.

1. create domains "domainA" and "domainB"
2. create user "userA" and project "projectA" in "domainA"
3. create user "userB" and project "projectB" in "domainB"
4. assign "userA" some role for "projectB"
5. disable "domainB"
6. authenticate to get a token for "userA" scoped to "projectB". This should fail as "projectB"'s domain ("domainB") is disabled.

Looks like the fix would be the check for the project domain to make sure it is also enabled. See

https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L112

[Dolph Mathews (dolph)]

Is this a regression?

[Guang Yee (guang-yee)]

I don't think we have a test case for this. We check the project's domain status only if it is specified. For example,

"scope": {
    "project": {
        "name": "projectA",
        "domain": {
            "name": "domainA"
        }
    }
}

However, when project ID is specified, project domain info is absent. Therefore, backend never check the project domain status.

"scope": {
    "project": {
        "id": "<project_id>"
    }
}

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/94251

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/94251
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5db0ce63f33f6d4aec43143ae6e6fa62ad5c9025
Submitter: Jenkins
Branch: master

commit 5db0ce63f33f6d4aec43143ae6e6fa62ad5c9025
Author: guang-yee <email address hidden>
Date: Mon May 19 12:14:38 2014 -0700

    Make sure scoping to the project of a disabled domain result in 401.

    Addresses the problem where we check for the validity of the scoped project,
    we did not subsequently making sure its domain is also enabled.

    Change-Id: I24e539aea9bb0ef0a22727fd9c1fb5d9d2ad1353
    Closes-Bug: 1315556

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/125364

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/125364
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=3817e757d1811459f50644cd9660e7a1a6e6335e
Submitter: Jenkins
Branch: stable/icehouse

commit 3817e757d1811459f50644cd9660e7a1a6e6335e
Author: guang-yee <email address hidden>
Date: Mon May 19 12:14:38 2014 -0700

    Make sure scoping to the project of a disabled domain result in 401.

    Addresses the problem where we check for the validity of the scoped project,
    we did not subsequently making sure its domain is also enabled.

    Change-Id: I24e539aea9bb0ef0a22727fd9c1fb5d9d2ad1353
    Closes-Bug: 1315556
    (cherry picked from commit 5db0ce63f33f6d4aec43143ae6e6fa62ad5c9025)